Handle CORS issues through standard Drupal config

[dafeder]

The SQL endpoint brings in its own response config to allow CORS exceptions, but this isn't a sustainable strategy as we build out other APIs that we need to expose to decoupled applications. We should roll this back and allow the SQL and other endpoints to pick up Drupal's CORS settings, and allow people to configure request origin headers per-site and per-environment.