fix: Access-Control-Request-Headers must join header names without whitespace

[youdie006]

Fixes #207

Problem

AccessControlRequestHeaders::from_iter collects HeaderNames into the shared FlatCsv, whose FromIterator joins with , (comma + space). But the Fetch CORS-preflight fetch spec specifies the Access-Control-Request-Headers value is a ,-joined list with no whitespace (it does not use combine). The WPT test access-control-preflight-request-header-sorted.py checks this strictly, and MDN's example value has no spaces. So the typed API currently emits accept-language, date instead of accept-language,date.

@seanmonstar acknowledged this in #207 ("Well that's unfortunate (as the spec even says).") but no fix was posted.

Fix

Give AccessControlRequestHeaders its own FromIterator<HeaderName> that joins the names with a plain , and wraps the result in a HeaderValue, instead of delegating to FlatCsv's , joiner. The change is localized: shared FlatCsv is left untouched, so other list headers (Vary, Allow, ...) keep emitting , .

The one existing from_iter test expectation is updated from "cache-control, if-range" to "cache-control,if-range", and a new test from_iter_no_space_between_names asserts the joined value is accept-language,date (no space).

Verification

• Red/green: with the old delegation the new test fails (accept-language, date); with the fix it passes.
• cargo test --lib: all pass, no regression.
• cargo fmt --check clean; cargo clippy introduces no new warnings.

---

This contribution was made with AI assistance.