Note that nowadays we have far more ResourceReferenceHandlers than webjar and vfs. I can see that Guillaume Delhumeau proposed in XWIKI-12246 a solution with an actual component, not sure why it's not been integrated like that in XS, see: https://github.com/gdelhumeau/xwiki-cors/blob/master/src/main/java/org/xwiki/platform/cors/CORSResourceReferenceHandler.java