x/website: allow CORS for golang.org/dl/?mode=json requests

[andybons]

Users should be able to fetch the JSON representation of releases via Cross-Origin Resource Sharing. This issue tracks that effort.

[gopherbot]

Change https://golang.org/cl/243118 mentions this issue: internal/dl: add CORS support to JSON endpoint