Add CORS configuration for OpenTelemetry HTTP endpoints

To enable [OpenTelemetry-instrumented browser applications](https://www.elastic.co/guide/en/apm/agent/rum-js/current/configuring-cors.html) to send data to APM Server, we should add CORS, like we support for the Elastic APM RUM JavaScript agent.

We should consider replacing `apm-server.rum.allow_{origins,headers}` with something more general, like `apm-server.cors.allow_{origins,headers}`, and have it apply to all HTTP endpoints.

Start by reviewing the existing Elastic APM RUM JavaScript agent CORS configuration and the HTTP endpoint handling. Decide how the proposed general CORS settings should replace or extend apm-server.rum.allow_{origins,headers}; done means OpenTelemetry-instrumented browser applications can send data while existing RUM behavior remains supported.

Written by the indexing model from the issue text.