[MadEyE355]

Description

Adds documentation for the Access-Control-Allow-Credentials HTTP response header to the HTTP Headers Cheat Sheet.

The new subsection covers:

• The purpose and valid value of the header.
• Its relationship with Access-Control-Allow-Origin and the wildcard restriction.
• Security recommendations for trusted-origin validation.
• Cookie security considerations and CSRF protection.
• Credentialed CORS preflight behaviour.

Checklist

• In case of a new Cheat Sheet, you have used the Cheat Sheet template.
• All the markdown files do not raise any validation policy violation.
• All the markdown files follow the format rules.
• All your assets are stored in the assets folder. (No new assets added.)
• All the images used are in PNG format. (No new images added.)
• Any references to websites have been formatted as [TEXT](URL).
• You verified/tested the effectiveness of your contribution.
• The CI build of your PR passes.

Scope and sourcing

• This PR modifies a single cheat sheet.
• [] Every technical claim, recommendation, or threat assertion is supported by a primary source linked inline.
• I have read each source I cite and independently verified its claims.

AI Tool Usage Disclosure

• I have NOT used any AI tool to generate the contents of this PR.
• I have used AI tools to generate the contents of this PR. I have verified the contents and I affirm the results. The LLM used is OpenAI ChatGPT GPT-6. The prompt used was Assist with researching, drafting, and reviewing an Access-Control-Allow-Credentials subsection for the OWASP HTTP Headers Cheat Sheet, including technical correctness, security recommendations, and Markdown formatting. I have independently verified every citation and technical claim against the cited source.

This PR fixes issue #2931.