Enable CORS on GraphQL API?

[sabine]

In order to enable cross-origin requests (i.e. HTTP requests coming from browsers that are visiting other domains) to the ocaml.org GraphQL API, the server would need to

1. add CORS headers, and
2. respond to CORS preflight requests

However, before we do this, we must ensure that the performance of all GraphQL queries is adequate, so that this does not impact the regular service of the website negatively.