Remove unnecessary match when checking allowed headers

If none are allowed _and_ headers are requested, then the first check
will fail anyway.
Simplify default cases for optional callbacks

Instead of handling 'no_call' everywhere, provide a means of
specifying a default value instead.  This achieves the same
functionality in most cases without the extra cases to handle.
Simplify interface for policy callbacks

The behaviour already makes it clear that the module is intended for
cross-origin policy definitions.  As such, it is clearer if every
callback is not prefixed with 'cors_'.

This ends up with policies being stylisticly similar to the
cowboy_rest handler.
Remove {shutdown, Req} as valid return for cowboy_cors_policy:policy_init/1

Right now, I'm not sure there is a genuine need for this, so removed
until such a time this has a definite use case.
Bump version due to interface changes