Allow to set Access-Control-Expose-Headers in Cors filter

Regarding to issue https://github.com/yiisoft/yii2/issues/6492