fix: add npm-* headers to CORS

[alexgleason]

Currently it's not possible to download JSR packages within browser environments (eg, in WebContainers). This fix adds CORS headers to prevent errors like this:

Access to fetch at
'https://npm.jsr.io/~/11/@jsr/nostrify__react/0.2.8.tgz' from origin 'https://h11gbxowc46vh5zy16u09l3mau3ohm-pock.w-corp-staticblitz.com' has been blocked by CORS policy: Request header
field npm-command is not allowed by Access-Control-Allow-Headers in preflight response.

[CLAassistant]

All committers have signed the CLA.

[alexgleason]

Can somebody please look at this? I'm blocked using jsr packages in WebContainers.