Enable cors for stac api

[danielfdsilva]

When making requests from the frontend app to https://stac.dev.ava.ds.io, it fails with a CORS error.

cc @alukach @gadomski

[alukach]

It seems that the core of this issue is that the STAC Auth Proxy is requiring auth for OPTIONS requests, despite the fact that OPTIONS never include credentials¹:

a CORS-preflight request never includes credentials.

Footnotes

1. https://fetch.spec.whatwg.org/#cors-protocol-and-credentials ↩