Set CORS headers for all .well-known responses

So we don't have to consider it for reverse proxies etc.

spec/requests/webfinger_spec.rb

@@ -94,6 +94,12 @@ RSpec.describe "WebFinger", type: :request do
           oauth_url = rs_link["properties"]["http://tools.ietf.org/html/rfc6749#section-4.2"]
           expect(oauth_url).to eql("http://www.example.com/rs/oauth/tony")
         end
+
+        it "returns CORS headers" do
+          get "/.well-known/nostr.json?name=bobdylan"
+          expect(response.headers['Access-Control-Allow-Origin']).to eq("*")
+          expect(response.headers['Access-Control-Allow-Methods']).to eq('GET')
+        end
       end
 
       context "remoteStorage not enabled for user" do