fix: update lazy compilation middleware order to apply devServer Middleware

[GiveMe-A-Name]

Summary

Lazy compilation middleware should apply devServer headers configuration to support user set Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers headers to avoid tigger CORS.

Related links

fix: #10044

Checklist

• Tests updated (or not required).
• Documentation updated (or not required).

[netlify]

✅ Deploy Preview for rspack canceled.

Name	Link
🔨 Latest commit	19f5d6f
🔍 Latest deploy log	https://app.netlify.com/projects/rspack/deploys/6891bbd590ddb20008cc6ed1

[Copilot]

Pull Request Overview

This PR fixes CORS issues in the lazy compilation middleware by adding necessary Access-Control headers to match webpack's lazy compilation backend implementation.

• Consolidates header setting into a single writeHead call with CORS headers
• Adds Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers headers with wildcard values

[github-actions]

📦 Binary Size-limit

Comparing 19f5d6f to refactor: native watcher to make codes clear (#11282) by qixuan

🙈 Size remains the same at 50.32MB

[JSerFeng]

It's not safe to use cors: '*', it's strange that dev server should already set cors headers as expected, is that lazy compile middleware run before that 🤔

[codspeed-hq]

CodSpeed Performance Report

Merging #11157 will not alter performance

_{Comparing fix/lazy-compiler-backend (19f5d6f) with main (f50011a)¹}

🎉 Hooray! codspeed-rust just leveled up to 2.7.2!

A heads-up, this is a breaking change and it might affect your current performance baseline a bit. But here's the exciting part - it's packed with new, cool features and promises improved result stability 🥳!
Curious about what's new? Visit our releases page to delve into all the awesome details about this new version.

Summary

✅ 17 untouched benchmarks

Footnotes

1. No successful run was found on main (a618407) during the generation of this report, so f50011a was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩