Handle private network preflight call (#354)

Chrome has a preflight check for local network requests that requires
our loopback listener to respond in a specific way in order to receive
the proper GET request.

Chrome document: https://developer.chrome.com/blog/private-network-access-preflight/

This document also says we need to include the
`Access-Control-Allow-Origin` header as well in order to succeed, but in
my (admittedly limited) tests that wasn't necessary. If it's deemed
prudent, I can add that to this PR as well.

Sources/AppAuth/macOS/OKTRedirectHTTPHandler.m

@@ -128,6 +128,30 @@ - (void)stopHTTPListener {
 }
 
 - (void)HTTPConnection:(HTTPConnection *)conn didReceiveRequest:(HTTPServerRequest *)mess {
+  // Handle private network preflight
+  // https://developer.chrome.com/blog/private-network-access-preflight/
+  CFStringRef method = CFHTTPMessageCopyRequestMethod(mess.request);
+  BOOL isOptionsRequest = CFStringCompare(method, (__bridge CFStringRef)@"OPTIONS", 0) == kCFCompareEqualTo;
+
+  CFStringRef requestPrivateNetwork = isOptionsRequest ? CFHTTPMessageCopyHeaderFieldValue(mess.request, (__bridge CFStringRef)@"Access-Control-Request-Private-Network") : nil;
+  BOOL doesRequestPrivateNetwork = requestPrivateNetwork != nil && CFStringCompare(requestPrivateNetwork, (__bridge CFStringRef)@"true", 0) == kCFCompareEqualTo;
+  if (isOptionsRequest && doesRequestPrivateNetwork) {
+    CFHTTPMessageRef response = CFHTTPMessageCreateResponse(
+                                                            kCFAllocatorDefault,
+                                                            200,
+                                                            NULL,
+                                                            kCFHTTPVersion1_1);
+    CFHTTPMessageSetHeaderFieldValue(response,
+                                     (__bridge CFStringRef)@"Access-Control-Allow-Private-Network",
+                                     (__bridge CFStringRef)@"true");
+    CFHTTPMessageSetHeaderFieldValue(response,
+                                     (__bridge CFStringRef)@"Content-Length",
+                                     (__bridge CFStringRef)@"0");
+    [mess setResponse:response];
+    CFRelease(response);
+      return;
+  }
+
   // Sends URL to AppAuth.
   CFURLRef url = CFHTTPMessageCopyRequestURL(mess.request);
   BOOL handled = [_currentAuthorizationFlow resumeExternalUserAgentFlowWithURL:(__bridge NSURL *)url];