API: Add Access-Control-Allow-Headers in CORS preflight response

Otherwise a CORS request won't be able to properly make use of the new
header.

Bug: T76340
Change-Id: I1dbccdf928b85a4b194174d38f505787dd18f745
Merge "API: Add Access-Control-Allow-Headers in CORS preflight response"