fix(cors): expose Retry-After so the login page can show the block time

src/main/java/auth_service/configuration/security/SecurityConfig.java

@@ -68,6 +68,8 @@ public class SecurityConfig {
         configuration.setAllowedOriginPatterns(Arrays.asList(allowedOrigins));
         configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
         configuration.setAllowedHeaders(List.of("*"));
+        // Lets the login page read how long a rate-limit block lasts
+        configuration.setExposedHeaders(List.of("Retry-After"));
         configuration.setAllowCredentials(false); // Set to true later if we use cookies
 
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();