Make interop-related JSON data available via CORS

[gsnedders]

To get the list of tests in Interop, you need to load:

1. https://wpt.fyi/static/interop-data.json
2. https://wpt.fyi/api/metadata?product=chrome&includeTestLevel

Neither of these are accessible cross-origin currently:

gsnedders@gsnedders-margot ~ % curl -I 'https://wpt.fyi/static/interop-data.json'
HTTP/2 200 
date: Fri, 01 Aug 2025 16:50:44 GMT
content-type: application/json
content-length: 82831
vary: Accept-Encoding
server: nginx/1.26.3
last-modified: Mon, 28 Jul 2025 17:55:43 GMT
etag: "6887b99f-1438f"
accept-ranges: bytes
via: 1.1 google

gsnedders@gsnedders-margot ~ % curl -I 'https://wpt.fyi/api/metadata?product=chrome&includeTestLevel'
HTTP/2 400 
date: Fri, 01 Aug 2025 16:51:17 GMT
content-type: text/plain; charset=utf-8
content-length: 20
server: nginx/1.26.3
strict-transport-security: max-age=31536000; preload
x-content-type-options: nosniff
via: 1.1 google

webapp/web/nginx.conf I think controls the former.

For the latter, I thought this was:

wpt.fyi/api/routes.go

Lines 67 to 72 in 9300450

	// API endpoint for searching Metadata for the products.
	shared.AddRoute(
	"/api/metadata",
	"api-metadata",
	shared.WrapApplicationJSON(shared.WrapPermissiveCORS(apiMetadataHandler)),
	)

This already has shared.WrapPermissiveCORS, but

[gsnedders]

Hmm, the behaviour is more subtle than that:

gsnedders@gsnedders-margot ~ % curl -I -X GET 'https://wpt.fyi/api/metadata?product=chrome&includeTestLevel'
HTTP/2 200 
date: Mon, 18 Aug 2025 21:06:23 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.26.3
strict-transport-security: max-age=31536000; preload
via: 1.1 google

gsnedders@gsnedders-margot ~ % curl -I -X GET -H 'Origin: https://example.com' 'https://wpt.fyi/api/metadata?product=chrome&includeTestLevel'
HTTP/2 200 
date: Mon, 18 Aug 2025 21:06:33 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.26.3
access-control-allow-origin: *
strict-transport-security: max-age=31536000; preload
via: 1.1 google

The first of these shows that we're not treating GET and HEAD equivalently. The second of these shows we only actually send access-control-allow-origin when origin is sent.

So I guess that does work, and I should file a separate issue for GET v. HEAD.