Send CORS headers

CORS headers are necessary for browsers to be able to reach the Tuleap API when
across domains (else they prevent access to tuleap.example.com API when we are
on tuleap.other-domain.tld).

Among those headers, there is Access-Control-Allow-Methods that has the same
purpose than Allow header. Therefore, whenever the Allow header is sent, we
should send the same value for the CORS one. Furthermore, Tuleap REST API
specifies[1] that *all* routes should send those headers.

[1] https://tuleap.net/wiki/index.php?pagename=RESt%20API&group_id=101#Cross_Origin_Resource_Sharing

Change-Id: If97734cc8a820d1e99d944c3fd076f2c89ef8f2e
Merge commit 'refs/changes/36/1436/3' of ssh://gerrit.tuleap.net:29418/tuleap into stable

* ssh://gerrit.tuleap.net:29418/tuleap:
  Send CORS headers

Change-Id: Ie2842de9b09fc6e49209d501f1ced5dd77222332
This is Tuleap 6.7.99.2

Change-Id: I58b5773eceb125df34d1ed7746045198efa586c6