Add Access-Control-Allow-Origin response header

[yifanmai]

Reasons for making this change

This allows websites not hosted CodaLab to make XMLHttpRequests to fetch files from CodaLab bundles.

Related issues

Addresses #4365

Checklist

• I've added a screenshot of the changes, if this is a frontend change
• I've added and/or updated tests, if this is a backend change
• I've run the pre-commit.sh script
• I've updated docs, if needed

[yifanmai]

My initial assessment that the header can only be added for public bundles is incorrect. It is safe to add the header to all responses, even for private bundles, because of the how requests with credentials work:

By default, in cross-origin XMLHttpRequest or Fetch invocations, browsers will not send credentials. A specific flag has to be set on the XMLHttpRequest object or the Request constructor when it is invoked... the browser will reject any response that does not have the Access-Control-Allow-Credentials: true header, and not make the response available to the invoking web content.

[epicfaace]

Please update this documentation to remove the "only sent if the bundle is public" part