[#1944] Allow CORS settings in config.

New config settings:
ckan.cors.origin_allow_all = <true|false>
ckan.cors.origin_whitelist = <space separated list of allowable domain origins>

Access-Control-Allow headers will only be set in the response if the
request contains an Origin header, the origin_allow_all setting is
present, and either:

a) the origin_allow_all setting is true, or
b) the request origin is listed in the origin_whitelist setting
[#1944] CORS config docs
[#1944] Add CORS changes to CHANGELOG
[#1944] Add CORS settings to deployment template.

These are commented out by default.
Merge branch 'brew-1944-cors-in-config'