refactor: migrate ENABLE_CORS_HEADERS and ENABLE_CROSS_DOMAIN_CSRF_COOKIE test overrides off FEATURES-as-dict

Both flags' production readers (openedx/core/djangoapps/cors_csrf/middleware.py) already
read flat settings.ENABLE_CORS_HEADERS / settings.ENABLE_CROSS_DOMAIN_CSRF_COOKIE. Two
tests still enabled them via @patch.dict(settings.FEATURES, {...}) sitting next to an
override_settings for the companion CORS_* settings. Fold the two flags into the adjacent
override_settings so no settings.FEATURES usage remains, and drop the now-unused patch
import in the cors_csrf test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>