Open Up SAME-ORIGIN to .mil sites

Is your feature request related to a problem? Please describe.
Currently water management is working towards using the Blob endpoint for storing and serving files to/from the cloud.

See:

• #1283

In order to embed and display various files within our new domain, which is now different from CDA's domain:

https://water.usace.army.mil vs https://cwms-data.usace.army.mil

We will need the SAME-ORIGIN to be relaxed and/or altered.

Describe the solution you'd like
I propose we somehow alter these lines:

https://github.com/USACE/cwms-data-api/blob/develop/cwms-data-api/src/main/java/cwms/cda/ApiServlet.java#L358-L360

To allow for all endpoints except the BLOB endpoint to keep the SAME ORIGIN. Make it so you can embed PDF and other files from Blob.

Additionally, not that we would (Someone might), but what if you wanted to fetch an html page and render that? Say, a report built in html but rendered in our React source?

Describe alternatives you've considered
Include CDA in the reverse proxy config for water.usace.army.mil/cwms-data. This was done previously, but would require everyone using this domain on their sites for cda. This also does not solve the issue for TEST/DEV/Local pages.

@willbreitkreutz may know why this was not done on the WAF already to match the previous setup?

Additional context

<object
    data={pdfUrl}
  type="application/pdf"
  width="100%"
  height="1000px"
>
  <embed
    src={pdfUrl}
    type="application/pdf"
    width="100%"
    height="1000px"
  />
  <p>
    Your browser does not support PDFs. Download the PDF{" "}
    <a href={pdfUrl}>here</a>.
  </p>
</object>

Start with cwms-data-api/src/main/java/cwms/cda/ApiServlet.java around lines 358-360 and review how the SAME-ORIGIN policy is applied. Read issue #1283 and compare the Blob endpoint with the other endpoints, including the stated water.usace.army.mil and cwms-data.army.mil use cases. Done means the intended Blob embedding behavior is supported without unintentionally relaxing protection for other endpoints.