Add more headers to Access-Control-Allow-Headers

We recently added functionality to proxy request headers to backend
services.

See https://github.com/alphagov/spotlight/pull/813

This code also runs in the browser, so we need to ensure that it isn’t
restricted by browser security. The other option would be not to try to
set those headers in the client.