Disable SockJS CORS headers by default

Allowing only same domain policy is a more secure default configuration.

This commit also adds a corsEnabled boolean property to AbstractSockJsService
and SockJsServiceRegistration to enable this behavior explicitly.

Issue: SPR-12283