Resolve CORS restrictions on feed URL endpoint

[reefdog]

Currently, we can't fetch the news feed URL via the plugin directly due to CORS restrictions. I'm temporarily working around that by bouncing the request through an open CORS proxy, but that's not an acceptable production solution.

We should preferably ensure the endpoint is configured with the BuildFire plugin server's URL (https://pluginserver.buildfire.com) in the Access-Control-Allow-Origin list. Less preferable would be setting up our own version of the CORS proxy. (Both of these are discussed in this article.)

Note: It's possible (but unproven) that STAT has already configured the endpoint to allow BuildFire's plugin server as an origin, which would mean this doesn't affect the plugin once deployed. If that's the case I'll close this, though probably leave the CORS proxy in the codebase as a localhost-only addition.