Repository: quarkusio/quarkus
Issue: [quarkus-keycloak] - CORS related properties should be optional otherwise they are set as an empty string

**Describe the bug**
When some of the CORS related properties are not explicitly set in `application.properties` they are parsed as an empty string.   

**Expected behavior**
The CORS properties that map to a `string` are optional and if not defined should resolve to `null`. 

The behavior differs from what users have when using any other Keycloak adapter. We need to keep the same behavior and user experience.

**Actual behavior**
The CORS properties that map to a `string` are set with an empty string, thus forcing users to explicitly set their values in order to properly enable CORS to the application.


**To Reproduce**
Steps to reproduce the behavior:

1. Create an application and install the `quarkus-keycloak` extension
2. Enable CORS in `application.properties` by setting `quarkus.keycloak.enable-cors=true`
3. Try to access the application from another `Origin` by passing a bearer token using the HTTP `Authorization` header.

By following the steps above, you should not be able to access the application due to the `Authorization` not being allowed by the extension. By default, if not defined, the extension should allow whatever header was requested during an HTTP  `OPTIONS` request.

**Configuration**
```properties
quarkus.keycloak.auth-server-url=http://localhost:8180/auth
quarkus.keycloak.realm=quarkus-quickstart 
quarkus.keycloak.resource=quarkus-rest-username
quarkus.keycloak.bearer-only=true
quarkus.keycloak.credentials.secret=secret
quarkus.keycloak.enable-cors=true
```

**Screenshots**
Not applicable.

**Environment (please complete the following information):**
 - Quarkus 0.15.0

**Additional context**
Not applicable.


Changed files:
extensions/keycloak/deployment/src/main/java/io/quarkus/keycloak/KeycloakAdapterProcessor.java
extensions/keycloak/deployment/src/main/java/io/quarkus/keycloak/KeycloakConfig.java

diff --git a/extensions/keycloak/deployment/src/main/java/io/quarkus/keycloak/KeycloakAdapterProcessor.java b/extensions/keycloak/deployment/src/main/java/io/quarkus/keycloak/KeycloakAdapterProcessor.java
index 633fd509a20..22a918a5bf9 100644
--- a/extensions/keycloak/deployment/src/main/java/io/quarkus/keycloak/KeycloakAdapterProcessor.java
+++ b/extensions/keycloak/deployment/src/main/java/io/quarkus/keycloak/KeycloakAdapterProcessor.java
@@ -74,9 +74,9 @@ private AdapterConfig createAdapterConfig(KeycloakConfig keycloakConfig) {
         config.setUseResourceRoleMappings(keycloakConfig.useResourceRoleMappings);
         config.setCors(keycloakConfig.cors);
         config.setCorsMaxAge(keycloakConfig.corsMaxAge);
-        config.setCorsAllowedHeaders(keycloakConfig.corsAllowedHeaders);
-        config.setCorsAllowedMethods(keycloakConfig.corsAllowedMethods);
-        config.setCorsExposedHeaders(keycloakConfig.corsExposedHeaders);
+        config.setCorsAllowedHeaders(keycloakConfig.corsAllowedHeaders.orElse(null));
+        config.setCorsAllowedMethods(keycloakConfig.corsAllowedMethods.orElse(null));
+        config.setCorsExposedHeaders(keycloakConfig.corsExposedHeaders.orElse(null));
         config.setBearerOnly(keycloakConfig.bearerOnly);
         config.setAutodetectBearerOnly(keycloakConfig.autodetectBearerOnly);
         config.setPublicClient(keycloakConfig.publicClient);
diff --git a/extensions/keycloak/deployment/src/main/java/io/quarkus/keycloak/KeycloakConfig.java b/extensions/keycloak/deployment/src/main/java/io/quarkus/keycloak/KeycloakConfig.java
index 0dc1c5b78f5..33cbecb30db 100644
--- a/extensions/keycloak/deployment/src/main/java/io/quarkus/keycloak/KeycloakConfig.java
+++ b/extensions/keycloak/deployment/src/main/java/io/quarkus/keycloak/KeycloakConfig.java
@@ -93,21 +93,21 @@ public final class KeycloakConfig {
      * string
      */
     @ConfigItem(name = "cors-allowed-headers")
-    String corsAllowedHeaders;
+    Optional<String> corsAllowedHeaders;
 
     /**
      * If CORS is enabled, this sets the value of the Access-Control-Allow-Methods header. This should be a comma-separated
      * string
      */
     @ConfigItem(name = "cors-allowed-methods")
-    String corsAllowedMethods;
+    Optional<String> corsAllowedMethods;
 
     /**
      * If CORS is enabled, this sets the value of the Access-Control-Expose-Headers header. This should be a comma-separated
      * string
      */
     @ConfigItem(name = "cors-exposed-headers")
-    String corsExposedHeaders;
+    Optional<String> corsExposedHeaders;
 
     /**
      * This should be set to true for services. If enabled the adapter will not attempt to authenticate users,