fix: Access-Control-Expose-Headers only set on preflight (#84)

`Access-Control-Expose-Headers` should be only the full request, NOT the preflight:

> An HTTP response to a CORS request that is not a CORS-preflight request can also include the following header

https://fetch.spec.whatwg.org/#http-access-control-expose-headers

Response/HeaderProvider/CorsExposeHeadersProvider.php

@@ -57,6 +57,6 @@ public function getValue()
 
     public function canApply(): bool
     {
-        return $this->validator->isPreflightRequest() && $this->validator->originIsValid() && $this->getValue();
+        return !$this->validator->isPreflightRequest() && $this->validator->originIsValid() && $this->getValue();
     }
 }