Errors from unknown endpoints should issue CORS headers, to avoid confusing web client users/devs

[matrixbot]

Submitted by @​matthew:matrix.org

(Imported from https://matrix.org/jira/browse/SYN-763)

[ara4n]

This still causes massive confusion when people point their client at some endpoint which 404s, but the client turns the 404 into a CORS error which makes them hunt CORS problems rather than realise it's a 404.

[turt2live]

Including ACAO / Access-Control-Allow-Origin

(added for keywords)

[richvdh]

fixed by #7534