facade: add CORS and default-SSE get/set helpers on Bucket (API symmetry)

[goanpeca]

Area: facade (src/bucket.ts)

Replication, lifecycle, and default-retention each have full read + write + add/remove helpers, but CORS is only reachable via Bucket.update({ corsRules }) and default SSE only via create/update. No getCorsRules/setCorsRules/addCorsRule/removeCorsRule or getDefaultEncryption/setDefaultEncryption.

Impact: inconsistent API; CORS (high-traffic for browser apps) forces hand-rolled read-modify-write-by-revision.

Expected: add CORS get/set/add/remove and default-SSE get/set helpers mirroring the existing config helpers.

Acceptance criteria:

• CORS helpers added
• default-SSE helpers added
• regression tests

Source: post-0.1.0 audit.