no CORS header for streaming API

Created by: rvantonder

No CORS header is set for streaming API, in particular, lack of Access-Control-Allow-Origin means browser requests from domains other than sourcegraph.com are blocked. Here's where most of our streaming headers are set:

https://github.com/sourcegraph/sourcegraph/blob/099c4418d881924f912b770004a3b8ca56845cf4/internal/search/streaming/http/writer.go#L32-L40

I think it makes sense to support for other web apps to use (related to https://github.com/sourcegraph/sourcegraph/issues/18847. I'm not sure whether we confirmed that we allow GQL requests from other origins since that was posted though--I'll see if I can confirm)