Continue to return CORS headers when function is disabled

This is a feature request to continue to return custom CORS headers when a Function App is disabled.

Without the CORS headers browser implementation of XMLHttpRequest means the status code '0' and empty status text is seen, so it's impossible to distinguish '403 (Site Disabled)' from various other issues when making a cross origin request.

If this is not possible, perhaps the option to return `Access-Control-Allow-Origin "*"` when the site is disabled?

No file, test, or entry point is named in the issue. Begin by tracing the disabled Function App response and its CORS configuration, then determine whether configured headers or a wildcard header should be returned and verify the browser-visible status behavior.

Written by the indexing model from the issue text.