Make upload.wikimedia.org set Timing-Allow-Origin

Cross-domain security restrictions limit the timing the timing
data that is available for images and media files.

This patch makes upload.wikimedia.org serve Timing-Allow-Origin: *
for the frontend, allowing the full timing data to be accessed.

Bug: T76020
Change-Id: Iaf4fbeffb62033ef59cb8287c248c96255384688