gateway: CORS and `Cache-Control: only-if-cached`

Without this you cannot make a CORS request for content with the `Cache-Controle` header.

For example, this request to check if the gateway has the cid in cache fails (from a different origin):
```
await fetch(new Request(`${url}/ipfs/${cid.toString()}/`, { method: 'HEAD', headers: { 'Cache-Control': 'only-if-cached' } }))
```

A server should be able to fix this by setting the header
```
"Access-Control-Allow-Headers"="Cache-Control"
```

This should probably be mentioned here: https://specs.ipfs.tech/http-gateways/path-gateway/#cache-control-request-header.

I believe @lidel mentioned setting this header alone might not be enough, but from some local testing, it seems to work fine(?)