Remove x-request-issuer header on cross-origin requests

[bgrgicak]

What is this PR doing?

Restricts the x-request-issuer header added in 9f134e0 added to local requests.

We can't just add this header to all external
requests because of CORS. The browser will refuse to process
cross-origin requests with custom headers unless the server
explicitly allows them in Access-Control-Allow-Headers.

Testing Instructions

• Checkout this branch
• Run npm run dev
• Open local Playground and confirm that the Add Plugins page is returning data
• Open network tools and see there are no CORS errors

[adamziel]

This breaks the site health part of wp-admin. In there, Request1 to PHP triggers wp_safe_http_get and issues Request2 to itself. However, Request2 can't acquire an exclusive lock required to serve it because that lock is already held by Request1. We need an E2E test to make something in CI flash red.

A neat solution would be to only include that header when the request domain is the same as the current document.location.host.