Add configurable CORS headers to raw Markdown / llms.txt responses

[fdileta]

The .md URL extension and llms.txt endpoints are perfect for programmatic consumption, but they send no Access-Control-Allow-Origin header, so they can't be fetched from a browser on a different origin, only server-side.

We want to surface our changelog (docs.acme.io/changelog/*.md) live inside our web app, a docs.json setting to send Access-Control-Allow-Origin on raw markdown/llms responses would enabled this. Plain GETs, no credentials, a single static header would do it.