fix: CORS: allow all request headers

[mattjohnsonpint]

Description

This allows all request headers in the GraphQL request. In particular, it avoids CORS errors when passing X-Time-Zone for Modus's local time feature.

Checklist

All PRs should check the following boxes:

• I have given this PR a title using the
  Conventional Commits syntax, leading with fix:,
  feat:, chore:, ci:, etc.
  • The title should also be used for the commit message when the PR is squashed and merged.
• I have formatted and linted my code with Trunk, per the instructions in
  the contributing guide.

If the PR includes a code change, then also check the following boxes. (If not, then delete the
next section.)

• I have added an entry to the CHANGELOG.md file.
  • Add to the "UNRELEASED" section at the top of the file, creating one if it doesn't yet exist.
  • Be sure to include the link to this PR, and please sort the section numerically by PR number.
• I have manually tested the new or modified code, and it appears to behave correctly.
• I have added or updated unit tests where appropriate, if applicable.