Enable CORS for with OTLP HTTP endpoint and add playground app

[JamesNK]

Fixes #4917

This PR:

• Builds on top of Add CORS to OTLP HTTP endpoint #5177. The previous PR allowed the dashboard to be configured to support CORS. This PR improves the host to automatically configure the dashboard with the allowed origins of all HTTP endpoints in the Aspire app.
• Adds a playground app that uses the opentelemetry-js SDK to send OTLP data to the dashboard.

Demo:

The eagle eyed might have noticed that the browser span started before the server span. It's caused by the browser and server clocks not being perfectly synced. They are off by about 10ms. As far as I can tell there isn't anything that we can do about it.

Microsoft Reviewers: Open in CodeFlow

[JamesNK]

cc @samsp-msft @aaronpowell @DamianEdwards

[mitchdenny]

Just thinking whether we need a threat model for this if only just to verify that we've though that we aren't making anything less secure by setting CORS up for all the resource endpoints. I don't think we do because someone who has compromised a web UI on one of the resource endpoints probably has control of the container the UI was launched from, at which point CORS isn't relevant.

[JamesNK]

Yes, that's the plan. I'm certain it will be fine, but it should be mentioned in those docs.

[mitchdenny]

LGTM. Added a few comments but nothing that should block.

[JamesNK]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).