[devtools] allow cross-origin requests for qunit
We have a mix of file:// html and http:// ajax calls. Which we should
at some point fix to all be http, but. Related to #4294727.
[cors] Fix CORS headers generators
The Access-Control-Allow-* and Access-Control-Expose-Headers are response
headers, not request headers.
Hence, we need generators for them. Closes #4412575.