Elsewhere: public.json -> %endpoint.json

The implementation is whitelist-based: only `public.json` and `charts.json` are implemented in this PR, since they're the only ones that set the appropriate CORS headers.

If we want others, I'd opt for making them a separate PR that adds CORS headers for them, as well.

NOTE: This PR is so that all of the things we add to the widgets JavaScript API can work with elsewhere.