Fix: Remove incorrect cors option type from apollo-server-express's constructor

[cheapsteak]

Fixes problem brought up in #2330 (comment) - cors options can only be applied to the standalone apollo-server's constructor, for apollo-server-express, their constructor can't contain cors settings, the option is only read from applyMiddleware

TODO:

• Update CHANGELOG.md with your change (include reference to issue & this PR)
• Make sure all of the significant new logic is covered by tests (NA)
• Rebase your changes on master so that they can be merged easily
• Make sure all tests and linter rules pass

[abernix]

Thanks!