Set Access-Control-Allow-Origin: * on API requests

This allows scripts from arbitrary sites to access API endpoints, and
only if the requests are unauthenticated.

See also:
https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS

Change-Id: I3b356fad9337ec79e3f69d402f918d14841249a0

gitiles-servlet/src/main/java/com/google/gitiles/BaseServlet.java

diff --git a/gitiles-servlet/src/main/java/com/google/gitiles/BaseServlet.java b/gitiles-servlet/src/main/java/com/google/gitiles/BaseServlet.java
index 1fbee33..e344b70 100644
--- a/gitiles-servlet/src/main/java/com/google/gitiles/BaseServlet.java
+++ b/gitiles-servlet/src/main/java/com/google/gitiles/BaseServlet.java
@@ -276,6 +276,7 @@
     res.setContentType(type.getMimeType());
     res.setCharacterEncoding(Charsets.UTF_8.name());
     res.setHeader(HttpHeaders.CONTENT_DISPOSITION, "attachment");
+    res.setHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "*");
     setCacheHeaders(req, res);
   }
 }