Allow CORS to be configured on SPSP and other HTTP endpoints

[sappenin]

We need CORS to be configurable in the Connector, especially for SPSP, but probably generally. The default should probably be */* or whatever, but we need to honor config here for proper ops deployment.

Also, see default SpringBoot functionality here - we should probably not do custom CORS if we can help it.

See https://spring.io/blog/2015/06/08/cors-support-in-spring-framework

[nhartner]

This shouldn't be necessary for Xpring wallet because we aren't doing CORS calls to the connector. We used to do CORS calls to Hermes but even that is gone because wallet calls Hermes on the same domain as the wallet (for JWT cookie sharing)