OK, I figured this out and will document for the next person:
There are multiple web.xml files. The correct web.xml file to which to add the and in the snippet above is:
{camunda directory}/server/apache-tomcat-9.0.5/webapps/engine-rest/WEB-INF/web.xml
and NOT:
{camunda directory}/server/apache-tomcat-9.0.5/conf/web.xml