My normal approach for “Use a JSON Asset Listing from Site A in Site B” is to create a Remote Content asset in Site B and point it the appropriate URL on Site A. No need to mess around with REST Resource assets. It’s not perfect, because by adding a “proxy” asset you complicate the situation when it comes to caching etc, but it does workaround the CORS issues by allowing you to access it “same origin”.
Alternatively, I haven’t done it myself but my understanding is that it’s possible to use triggers to send the correct CORS headers for specific URLs.
Futurely, there is a SquizMap on the topic of “defining a greater variety of https headers without triggers” at https://squizmap.squiz.net/matrix/5978 , which seems to have some recent activity. With any luck, whatever shakes out of that will make it easier to use the direct CORS approach in the future .