Allow allowedHeaders and exposeHeaders to receive false

[tkesgar]

Currently, the plugin sends a set of default headers for Access-Control-Allowed-Headers and Access-Control-Expose-Headers:

We can actually set allowedHeaders and exposeHeaders to false to avoid sending the headers:

const app = new Elysia()
  .use(cors({
    allowedHeaders: false as any,
    exposeHeaders: false as any,
  }))

This PR updates the types so false is accepted as value for the options.