This script demonstrates the issue. https://meta.wikimedia.org/wiki/User:EpochFail/demo_ores_user_agent_issue.js
In Chrome I see the following error when I try to load the script:
Access to XMLHttpRequest at 'https://ores.wikimedia.org/v3/scores/enwiki/1324234' from origin 'https://meta.wikimedia.org' has been blocked by CORS policy: Request header field api-user-agent is not allowed by Access-Control-Allow-Headers in preflight response.