Move `.htaccess` into `src/`
Merge CORS web fonts configs into main CORS

Move the `web fonts access` configurations into the `Cross-domain
requests` subsection as they are just a more restrictive case, not
a distinct one.
Add tests ✨
Add badges