Thank you @jt97 for this link. Making such change indeed changed the Istio-proxy config when I check it with istioctl proxy-config.
It’s a shame this change is not documented.
Unfortunately, it didn’t solve my problem.
I still don’t see any of the access-control-* headers.
Instead, I still get 404 error if I send a request with OPTIONS method as shown in my original post.