fix(core): preserve explicit public resource embedding policies

packages/core/test/public-image-policy.test.ts

@@ -0,0 +1,10 @@
+import {expect,test} from "bun:test";
+import {withSecurityHeaders} from "../src/headers.ts";
+test("explicit response resource policies survive defaults while configured application policy wins",()=>{
+  const req=new Request("https://example.com/image.png");
+  const image=()=>new Response("image",{headers:{"Cross-Origin-Resource-Policy":"cross-origin","Content-Type":"image/png"}});
+  expect(withSecurityHeaders(req,image(),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
+  expect(withSecurityHeaders(req,new Response("private"),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+  expect(withSecurityHeaders(req,image(),"production",{crossOriginResourcePolicy:"same-origin"}).headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+  expect(withSecurityHeaders(req,new Response("x",{headers:{"Cross-Origin-Resource-Policy":"invalid"}}),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+});