upload: add X-Content-Duration to CORS exposed headers

Change-Id: I75ba126e24b978fd2d688da0979ccdc0e6932a7e