Handle CORS preflight requests for upload in VCL

ogv.js needs to be able to send Range requests to handle video seeking.
These come from our project domain names and go to upload, i.e. they are
cross-domain, and unfortunately, Range is not whitelisted by browsers as
an allowed header.

This means that we need to handle CORS preflight requests (OPTIONS) and
explicitly respond to browsers that they're allowed to send a
cross-domain Range header... This results in another round-trip but
seems unavoidable (so far).

Swift has some support for CORS, but seems to be per container. This is
much easier to handle in Varnish and not too ugly either, so add a few
lines that would handle those OPTIONS requests and reply accordingly.
Note that we respond with a "*" allowed origin for now as there doesn't
seem to be any reason to restrict it to only our origins.

Bug: 55631
Change-Id: I6e381d9b4f4692d1eabeb777ee8cdb7fae1de3f2