tokenrequest.callbackServer does not implement CORS / PNA

The callbackServer in pkg/oauth/tokenrequest/callback_server.go does not implement CORS / Private-Network-Access, which might result in browser based authentication flows becoming unusable in future versions of Chrome: https://developer.chrome.com/blog/private-network-access-preflight