Use `crossorigin="use-credentials"` for manifest files

[brianstorti]

trafficstars

When running Airbyte behind an authentication proxy (in my case, GCP's Identity-Aware Proxy), the manifest.json request will always fail with a CORS error, like:

Access to manifest at 'https://accounts.google.com/o/oauth2/v2/auth?client_id=465372...' 
(redirected from 'https://airbyte.mydomain.com/manifest.json') from origin
'https://airbyte.mydomain.com' has been blocked by CORS policy: No
'Access-Control-Allow-Origin' header is present on the requested resource.