Issue #3396634 by dewalt: CORS headers aren't applied to the module response

use Drupal\Component\Utility\UrlHelper;

use Drupal\Core\Config\ConfigFactoryInterface;

use Drupal\Core\Routing\TrustedRedirectResponse;

use Drupal\Core\StreamWrapper\StreamWrapperManager;

use Drupal\Core\Url;

use Drupal\stage_file_proxy\DownloadManagerInterface;

use Psr\Log\LoggerInterface;

use Symfony\Component\EventDispatcher\EventDispatcherInterface;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;

use Symfony\Component\HttpFoundation\RedirectResponse;

use Symfony\Component\HttpFoundation\RequestStack;

use Symfony\Component\HttpKernel\Event\RequestEvent;

use Symfony\Component\HttpKernel\KernelEvents;

      ];

      if ($config->get('hotlink')) {

        $location = Url::fromUri("$server/$remote_file_dir/$relative_path", [

          'query' => $query_parameters,

          'absolute' => TRUE,

        ])->toString();

        $response = new TrustedRedirectResponse($location);

        $response->addCacheableDependency($config);

        $event->setResponse($response);

      }

      elseif ($this->manager->fetch($server, $remote_file_dir, $fetch_path, $options)) {

        // Refresh this request & let the web server work out mime type, etc.

          'query' => $query_parameters,

          'absolute' => TRUE,

        ])->toString();

        // Avoid redirection caching in upstream proxies.

        header("Cache-Control: must-revalidate, no-cache, post-check=0, pre-check=0, private");

      }

      if (isset($location)) {

        header("Location: $location");

        exit;

        // Use default cache control: must-revalidate, no-cache, private.

        $event->setResponse(new RedirectResponse($location));

      }

    }

  }