Populate GMPID header

[schmidt-sebastian]

This is the exact same as #2670, that was reverted in #2696 since it broke CORS preflight requests.

We have since whitelisted the new header in CORS:

> Request URL: https://firebasestorage.googleapis.com/v0/b/***/o***
> Request Method: OPTIONS
< access-control-allow-headers: authorization,x-firebase-gmpid,x-firebase-storage-version,x-goog-upload-command,x-goog-upload-offset

> Request URL: https://firebasestorage.googleapis.com/v0/b/***/o***
> Request Method: POST
> x-firebase-gmpid: 1:***:web:***
< Status Code: 200 

[schmidt-sebastian]

@jsdt confirmed that the backend is fully rolled out.