[WIP] Adding CORS support in responses

This is the API preparation to get rid of apache mod_proxy definitions in our MAP application. This only makes sense if the corresponding PR (https://github.com/geoadmin/mf-geoadmin3/pull/1508) in ga3 will be merged.
Will referrer check still work ?