Add PATCH to the allowed methods

[smcmurtry]

Summary | Résumé

Add PATCH to the allowed methods - this is likely the reason the PATCH endpoint requests are failing on our swagger doc site.

Reviewer checklist | Liste de vérification du réviseur

• This PR does not break existing functionality.
• This PR does not violate GCNotify's privacy policies.
• This PR does not raise new security concerns. Refer to our GC Notify Risk Register document on our Google drive.
• This PR does not significantly alter performance.
• Additional required documentation resulting of these changes is covered (such as the README, setup instructions, a related ADR or the technical documentation).

⚠ If boxes cannot be checked off before merging the PR, they should be moved to the "Release Instructions" section with appropriate steps required to verify before release. For example, changes to celery code may require tests on staging to verify that performance has not been affected.

[Copilot]

Pull request overview

Adds PATCH to the CORS Access-Control-Allow-Methods response header so browser-based clients (including the Swagger docs site) can successfully call PATCH endpoints.

Changes:

• Extend CORS allowed methods header to include PATCH.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.