Replace 3rd party libraries with proxied/CORS HTTP API requests

Captured concern from the firefox-dev thread, to only have 1st party trusted scripts in the page at all times.

We need to review how feasible a server component is for perf.html (possibly while moving to a Mozilla-supported hosting infrastructure). CORS would be a possible fallback but still leak the user's IP.

* [x] #645 bit.ly CORS
* [x] GA CORS (aka Measurement Protocol)
* [ ] Proxy all HTTP APIs to not call 3rd party services directly

┆Issue is synchronized with this [Jira Task](https://mozilla-hub.atlassian.net/browse/FP-673)

Start by reviewing perf.html's existing third-party HTTP API calls and the hosting constraints described in the issue. The work is complete when those APIs are handled through a server-side proxy rather than called directly from the page, with the feasibility and hosting approach resolved.

Written by the indexing model from the issue text.