private Node updateGatewayResponses(
            Context<? extends Trait> context,
            CorsTrait trait,
            ObjectNode gatewayResponses
    ) {
        Map<CorsHeader, String> corsHeaders = new HashMap<>();
        corsHeaders.put(CorsHeader.ALLOW_ORIGIN, trait.getOrigin());

        // Include an 'Access-Control-Allow-Credentials' header if any security scheme requires
        // browser-managed credentials.
        if (context.usesHttpCredentials()) {
            corsHeaders.put(CorsHeader.ALLOW_CREDENTIALS, "true");
        }

        return gatewayResponses.getMembers()
                .entrySet()
                .stream()
                .collect(ObjectNode.collect(Map.Entry::getKey, entry -> {
                    return updateGatewayResponse(context, trait, corsHeaders, entry.getValue().expectObjectNode());
                }));
    }
The default gateway response for 4xx and 5xx.

TODO: Does this need to be made protocol-specific?
smithy-aws-apigateway-openapi/src/main/java/software/amazon/smithy/aws/apigateway/openapi/AddCorsToGatewayResponses.java