Which party should set the Timing-Allow-Origin header?

Question

Given a server APP that serves an Angular App to a web browser, an Apollo GraphQL server and a third-party tracking script by Instana.

If the tracking script is run i