fix: filter CORS headers in response to prevent duplicate header conf…

[gogui63]

When accessing Scrypted through Home Assistant's ingress proxy behind a
reverse proxy (e.g., nginx), CORS headers from Scrypted were being passed
through to the client. This caused conflicts with CORS headers added by
Home Assistant itself, resulting in an AssertionError:

AssertionError: assert hdrs.ACCESS_CONTROL_ALLOW_CREDENTIALS not in response.headers

This occurred because aiohttp's CORS middleware detected duplicate
Access-Control-Allow-Credentials headers.

Changes:

• Updated _response_header() to filter out CORS-related headers from
  Scrypted's responses (Access-Control-Allow-Origin, Allow-Credentials,
  Allow-Methods, Allow-Headers, Expose-Headers, Max-Age)
• Updated retrieve_token() to support both the legacy API response
  format (token field) and the newer format (authorization field with
  Bearer prefix)

This fix enables Scrypted integration to work correctly when Home Assistant
is accessed through an external reverse proxy with HTTPS.

Tested configuration:

• Home Assistant behind nginx reverse proxy (external HTTPS access)
• Scrypted server on local network
• Integration configured with local IP:port (192.168.10.10:10443)

---

Problem

Users accessing Home Assistant remotely through a reverse proxy (nginx,
Traefik, Caddy, etc.) were unable to use the Scrypted integration. The
panel would fail to load with a cryptic CORS error in Home Assistant logs.

This is a common setup for users who want secure external access to their
Home Assistant instance without exposing it directly to the internet.

Root Cause

1. Scrypted server returns CORS headers in its responses
2. Home Assistant's aiohttp server adds its own CORS headers
3. The integration's ingress proxy was passing through Scrypted's CORS
   headers unchanged
4. This resulted in duplicate CORS headers, which aiohttp strictly rejects

Additionally, the Scrypted API has evolved and now returns authentication
tokens in a different format (authorization: Bearer xxx instead of
token: xxx), which caused login failures in some configurations.

Solution

Filter out all CORS-related headers from Scrypted's responses before
forwarding them to the client, letting Home Assistant handle CORS
consistently. Also added backward-compatible token parsing to support
both old and new Scrypted API responses.