Consider enabling CORS (at least for OData?)

as noted [here](https://forum.opendatakit.org/t/unable-to-access-odk-central-via-ajax-calls/19234), browser-based clients hoping to read information from Central won't be able to do so unless the server permits CORS requests.

at the very least, OData seems like a prime candidate for CORS allowance.

but we need to think through the security ramifications if we're going to allow this, and decide whether it should be on by default or toggled via some kind of option somehow.

should we decide to do this at the nginx level, the above-linked thread has some useful configuration.