pd: cors headers not being served (regression)

[conorsch]

Describe the bug
Back in #3281 we modified pd to serve permissive cors headers directly. Some time in the intervening period that behavior was lost. First reported by @grod220 yesterday.

To Reproduce
Steps to reproduce the behavior:

1. Run pd locally on your machine.
2. Run curl -I http://localhost:8080

Expected behavior
Displayed headers should include:

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *

Additional context
We can temporarily patch the hosting config to re-apply these headers. That's what I've done as a stopgap to unblock the web team. Those ad-hoc changes will be dropped on the next CI deploy, though, so we should try to fix the problem in pd.

[conorsch]

It's worth pointing out that we overlooked this regression because we didn't bother to wire up tests in CI to confirm the behavior. We should add a simple header check via the integration tests, which talk to pd directly, to make sure the headers are preserved during refactors.

[conorsch]

Git bisect points to e7bcdba as the first bad commit, which makes sense: it was a substantial refactor. See PR #3652 for context. I'm going to pair with @cratelyn briefly today to try to restore the original functionality; if we don't achieve that in the timebox, then we'll stick with the stopgap solution of applying headers at the ingress layer to accommodate web team needs.