Missing CORS response header for static file assets

Describe the bug The static file handler of the http plugin is missing the extra headers for Access-Control-Allow-*. This is already correctly done for the JSON-RPC handler. The issue is that is not possible to fetch static assets due to CORS issues even the request origin is whitelisted.

How to reproduce Make sure that the domain you are using is whitelisted in the configuration:

[http]
allowed_origins = localhost:8080

Launch the client, open the console and try to do a fetch of an asset you know:

fetch('http://localhost:6080/local/feecccb956b1764b8245244611a61e15-600x600.jpeg')

This will give the following type error:

Access to fetch at 'http://localhost:6680/data/local/feecccb956b1764b8245244611a61e15-600x600.jpeg' from origin 'http://localhost:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Expected behaviour Cross origin requests should work for static assets if the request origin is whitelisted.

Environment Please complete the following information:

• Operating system: 5.9.4-arch1-1
• Running Mopidy as a service or in the terminal? service
• Your config (output of sudo mopidyctl config): command fails
• Software versions (output of sudo mopidyctl deps): command fails

Additional context I think the issue should be quite easy to solve by extending the set_extra_headers() function of the StaticFileHandler as it is already done here. Is that correct?