TL;DR
Use <<EOF instead of <<'EOF'.
This is what POSIX says about here-documents [emphasis mine]:
[n]<<word
here-document
delimiter
[…]
If any part of word is quoted, the delimiter shall be formed by performing quote removal on word, and the here-document lines shall not be expanded. Otherwise, the delimiter shall be the word itself.
If no part of word is quoted, all lines of the here-document shall be expanded for parameter expansion, command substitution, and arithmetic expansion. […]
In your case word is 'EOF' (quoted!), so $package inside the here-document is not expanded. Drop these quotes and you will get the desired result.
cat > out.json <<EOF
{
"apps": [
{
"cwd":"/usr/local/$package"
}
}
EOF
Note this has nothing to do with quotes that surround the variable inside the here-document.