Change CORS headers to allow JS queries

[dq18]

Open-prices will soon have to query this API. Either allow origin for prices.openfoodfacts.[org, net] or allow_header=["*"]

[alexfauquette]

Upvoted this issue. The implementation is ready, but even from hunger.openfoodfacts.org it returns a CORS

https://hunger.openfoodfacts.org/logos/search?type=brand

[alexgarel]

I think we can go for allow_header=["*"] as it's intended for public use.