I'm pretty sure this is a long-dead post, but here's the solution in case anybody else is thick like me and takes a few minutes to figure it out...
Well, I hope everyone's ok and I'm sure you'll all be embarassed after you hear how rudimentary this is...
The fix for me was to simply use the ScriptAlias directive
ScriptAlias /cgi-bin "/web/site/foo-bar/cgi-bin"
here's the apache documentation on it:
The ScriptAlias directive has the same behavior as the Alias directive, except that in addition it marks the target directory as containing CGI scripts that will be processed by mod_cgi's cgi-script handler. URLs with a (%-decoded) path beginning with URL-path will be mapped to scripts beginning with the second argument which is a full pathname in the local filesystem.
and I just emulated the apache default config for the cgi-bin directory that I found in their config file...
Allow from all