to enable CORS tag API

we create a web UI for docker-registry.
https://github.com/worksap-ate/docker-registry-ui
deployed application is here
http://worksap-ate.github.io/docker-registry-ui/#/

This application have the feature to rename, and delete a tag.
So, We fork docker-registry to allow CORS request of tag API.
Can you merge this?

What happens if we have only `origins: _env:CORS_ORIGINS`?