it's allowed; see https://www.rfc-editor.org/rfc/rfc9110#section-5.3 (emphasis mine):

a sender MUST NOT generate multiple field lines with the same name in a message (whether in the headers or trailers) or append a field line when a field line of the same name already exists in the message, unless that field's definition allows multiple field line values to be recombined as a comma-separated list (i.e., at least one alternative of the field's definition allows a comma-separated list, such as an ABNF rule of #(values) defined in Section 5.6.1).

Section 5.6.1 defines "a #rule extension to the ABNF rules of RFC5234… for defining comma-delimited lists of elements… and optional whitespace".

Access-Control-Request-Headers is registered with reference to WHATWG Fetch, which describes its values as ABNF 1#field-name, where "ABNF" explicitly includes HTTP #.