CDAWeb: CORS for landing but not other endpoints

[rweigel]

It seems that if the landing supports CORS, that the other endpoints should.

curl -I https://cdaweb.gsfc.nasa.gov/hapi
HTTP/1.1 200 200
Date: Sat, 17 Feb 2024 21:57:44 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' *.gsfc.nasa.gov;
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Length: 1691

curl -I https://cdaweb.gsfc.nasa.gov/hapi/catalog
HTTP/1.1 200 200
Date: Sat, 17 Feb 2024 21:57:09 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' *.gsfc.nasa.gov;
Content-Type: application/json