Enable CORS on the AppSync Admin APIs

I'm trying to list the AppSync API's using the V3 JavaScript SDK from a web browser. The call fails with "Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://appsync.us-west-2.amazonaws.com/v1/apis. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing)."

If I inspect the network calls I see a successful `OPTIONS` request to `https://appsync.us-west-2.amazonaws.com/v1/apis` that contains the headers:

```
access-control-allow-origin: *
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-Content-Sha256,X-Amz-User-Agent
```

The browser then proceeds to perform a `GET` but the response to the `GET` request is missing those headers which causes the browser to throw a CORS error. Could those headers be added to all responses?

Start by reproducing the V3 JavaScript SDK request to https://appsync.us-west-2.amazonaws.com/v1/apis in a browser and compare the successful OPTIONS response with the GET response. Done means the relevant AppSync API responses include the required CORS headers, including Access-Control-Allow-Origin, so the browser can read the GET result.

Written by the indexing model from the issue text.