[WOPI][CORS] /app/open url does not send appropriate cors headers for public links

## Describe the bug

When trying to open a file in the external app in web hosted another domain (e.g. the web development server) it fails because of cors errors.

## Steps to reproduce
Steps to reproduce the behavior:

1. Start Web development server like this: `OWNCLOUD_WEB_CONFIG_URL="https://your.wopi.enabled.cors.owncloud.works/config.json" pnpm vite`
2. Open a document in the external app (e.g. a .docx file) in your personal space -> works
3.Open a document in the external app in a public link -> fails with cors errors

## Expected behavior
File can be opened in a public link

## Actual behavior
CORS errors.

```
Access to XMLHttpRequest at 'https://HOST/app/open?file_id=339b67aa-e2df-4de4-b4cd-6152a8b68c18%24d875e6b8-7b8d-4ccd-9ef4-4ed4fa548b7e%21ca1e0186-f35c-44ba-8612-6754ef88af83&lang=en&app_name=OnlyOffice&view_mode=view' from origin 'https://host.docker.internal:9201' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
```

I assume the main difference here might be that we're authenticating with public-token header instead of Authorization header...
```
-H 'public-token: poTaPWrFBQtbZHN' \
```