Add CORS support

[cben]

Closes #29. I hope.

Testing with this UI patch:

--- src/app/where/page.tsx
+++ src/app/where/page.tsx
@@ -43,7 +43,7 @@ export default function Where() {
   useEffect(() => {
     const fetchData = async () => {
       try {
-        const response = await fetch(`${process.env.API_URL}/schedule`)
+        const response = await fetch(`https://localhost:8443/schedule`)
         const fetchLocation = await response.json()

(setting API_URL seems not working right now)

Result

before	after

test commands used, for "simple" vs. preflight modes respectively:

curl -i --insecure -X GET -H 'Origin: foo.bar' https://localhost:8443/users
curl -i --insecure -X OPTIONS -H 'Origin: foo.bar' -H 'Access-Control-Request-Method: POST' -H 'Access-Control-Request-Headers: Content-Type' https://localhost:8443/users

---

• Also documented some issues with the self-signed cert (out of scope here).

[masayag]

Created #37 to track this

[masayag]

Thank you, Beni!

[cben]

Forgot to mention on choice of packages: rs/cors package is popular; chi router had forked it into their own go-chi/cors with major differences listed here: go-chi/cors#21. Looks like the more important stuff made it back into rs/cors.

Unlikely to matter for us, we're good with default CORS config and rs/cors looked like simpler bet with official support for many routers. Anyway would be easy to switch in future if needed.