gateway: add CORS to specs

[lidel]

Currently, gateway specs leave CORS to implementers, but various things will not work on public gateways (path, subdomain, and trustless) unless relaxed CORS is set, like we do in boxo/gateway.

### Tasks
- [ ] add https://specs.ipfs.tech/http-gateways/cors -  a standalone spec documenting CORS behavior on different gateway types and use cases. 
- [ ] make existing path gateway, subdomain gateway (mention caveat from https://github.com/ipfs/kubo/issues/9983#issuecomment-1599673976), trustless, dnslink refer the cors spec + describe only own delta
- [ ] make existing routing/v1 specs refer to it as well
- [ ] resolve open question about Cache-Control (https://github.com/ipfs/specs/issues/400)
- [ ] make sure it covers CORS, `Vary: Origin`, and HTTP Caching ramifications identified in https://github.com/ipshipyard/waterworks-community/issues/7