gateway: add CORS to specs

Currently, gateway specs leave CORS to implementers, but various things will not work on public gateways (path, subdomain, and trustless) unless relaxed CORS is set, like we do in `boxo/gateway`.

- [ ] add https://specs.ipfs.tech/http-gateways/cors - a standalone spec documenting CORS behavior on different gateway types and use cases.
- [ ] make existing path gateway, subdomain gateway (mention caveat from https://github.com/ipfs/kubo/issues/9983#issuecomment-1599673976), trustless, dnslink refer the cors spec + describe only own delta
- [ ] make existing routing/v1 specs refer to it as well
- [ ] resolve open question about Cache-Control (https://github.com/ipfs/specs/issues/400)
- [ ] make sure it covers CORS, `Vary: Origin`, and HTTP Caching ramifications identified in https://github.com/ipshipyard/waterworks-community/issues/7