[identity] pull out CORS logic

Summary: tonic_web::enable() is convenient but doesn't let us set a custom CORS configuration. as a result, the server currently rejects request headers "code_version" and "device_type" from web. therefore, i'm modifying our Server builder to take a cors layer and a GrcpWebLayer. it's slightly more verbose, but we need this to send request metadata over grpc-web.

Test Plan: confirmed the metadata could be parsed when i sent a GenerateNonce request to my local identity service from web

Reviewers: bartek, michal, jon, ashoat

Reviewed By: bartek, michal

Subscribers: ashoat, tomek, wyilio

Differential Revision: https://phab.comm.dev/D9670