Allow Access-Control-Allow-Origin=* on /versions API

[agoose77]

This PR is the BinderHub counterpart to jupyterhub/jupyterhub#4966. It is intended to expose the unauthenticated /versions API call to cross-origin queries, enabling use in contexts where CORS would otherwise prohibit the fetch.

By merging this PR, all BinderHub deployments will now be able to answer a question of the form "are you a BinderHub", which is useful for us over in the Jupyter Book ecosystem (see the above PR!)

I took the same approach here as JupyterHub, so I hope it's not a contentious PR!

[agoose77]

Thanks for the approval @minrk :)

I assume that the failed test job is unrelated to this PR.

[manics]

The original test run failed due to an external problem, I've rerun them and this looks like a genuine error, all tests are passing on the main branch.