Gitpod: Make 'ports' private once upstream CORS issue has been fixed

**UPDATE** I think this is a Gitpod issue and nothing can be done except wait for them to fix it. https://github.com/gitpod-io/gitpod/issues/14576

So far I was unable to make the frontend work with the backend with private ports.

The reason seems to be that:

* With private ports, Gitpod requires authentication (presumably cookies)
* The HTTP requests made by the GUI don't include this authentication by default due to security reasons (default browser behaviour)

Therefore the GUI fails to reach the API even if the API is very permissive where CORS is concerned.

To fix this apparently the following is necessary (see: https://www.gitpod.io/docs/configure/workspaces/ports#cross-origin-resource-sharing-cors):
* Set `credentials: "include"` for `fetch` requests in the GUI
* Ensure the API returns the `Access-Control-Allow-Credentials` header. This in turn requires:
* Access-Control-Allow-Origin, Access-Control-Allow-Headers and Access-Control-Allow-Methods can't be set to asterisk \* (see: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
* Set that header e.g. enable `AllowCredentials: true`

Despite trying to achieve all that, it didn't work.

The OPTIONS `fetch` request was failing with 401. I wonder whether Gitpod expects that request to already include the authentication, even though according to the CORS spec these OPTIONS requests must not send authentication info.

Also check #26 for some more info.

Start by reading the linked Gitpod issue 14576 and issue #26, then review the described private-port CORS failure and the failed OPTIONS request. There are no files or tests named; the work is complete only when the upstream limitation is resolved and the frontend can reach the backend through private ports.

Written by the indexing model from the issue text.