[Bug]: CORS issues with browser extension in 'on click' mode

### Describe the bug

Chrome has a feature where you can limit what domains a given extension can interact with. To access this, right click on the extension and choose "This site can read and change site data >".

If you switch to 'on click the extension' / per-domain mode, MetaMask becomes unable to talk to infura / metamask subdomains due to CORS preflight failures (as seen by debugging the MM extension background page).

### Expected behavior

MetaMask works when limited to on click mode

### Screenshots/Recordings

_No response_

### Steps to reproduce

Install Chrome.
Install MetaMask.
Limit MetaMask access to per-domain / 'on click extension', rather than 'can read data on all sites'.
Notice that the dapp doesn't work and cannot access blockchain data.
Network fees cannot be retrieved
Transactions cannot be executed

### Error messages or log output

```shell
Access to fetch at 'https://tx-sentinel-ethereum-mainnet.api.cx.metamask.io/networks' from origin 'chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn' has been blocked by CORS policy: Request header field authorization is not allowed by Access-Control-Allow-Headers in preflight response.
```

### Where was this bug found?

Live version (from official store)

### Version

13.25.0

### Build type

None

### Browser

Chrome

### Operating system

MacOS

### Hardware wallet

_No response_

### Additional context

_No response_

### Severity

_No response_

[Jira issue](https://consensyssoftware.atlassian.net/browse/MCTP-193)

### Expected behavior

No response

### Screenshots/Recordings

No response

### Steps to reproduce

Install Chrome.
Install MetaMask.
Limit MetaMask access to per-domain / 'on click extension', rather than 'can read data on all sites'.
Notice that the dapp doesn't work and cannot access blockchain data.
Network fees cannot be retrieved
Transactions cannot be executed

### Error messages or log output

```shell
Access to fetch at 'https://tx-sentinel-ethereum-mainnet.api.cx.metamask.io/networks' from origin 'chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn' has been blocked by CORS policy: Request header field authorization is not allowed by Access-Control-Allow-Headers in preflight response.
```

### Where was this bug found?

No response

### Version

13.25.0

### Build number

No response

### Build type

None

### Browser

Chrome

### Operating system

MacOS

### Hardware wallet

No response

### Additional context

No response

### Severity

No response

Start by reproducing the failure in Chrome with MetaMask 13.25.0 and inspect the preflight request to the tx-sentinel-ethereum-mainnet.api.cx.metamask.io/networks endpoint. Trace whether the required change belongs in the extension or the API's CORS handling; done means on-click mode can retrieve fees and execute transactions without the reported preflight failure.

Written by the indexing model from the issue text.