`CorsEndpointProperties` lives in `endpoint.web.servlet` but is also used
in `endpoint.web.reactive`, so this PR moves it to its common parent
package.

This commit also extracts `CorsConfiguration` creation logic duplicated
in `WebMvcEndpointManagementContextConfiguration` and
`WebFluxEndpointManagementContextConfiguration` into
`CorsEndpointProperties`.

See gh-11439