Set permissive CORS headers in production

This is safe as:

- the parsoid service provides no editing etc, only HTML + wikitext
  conversions

- it runs on a cookie-less domain (parsoid-lb.eqiad.wikimedia.org)

This is needed so that gadgets etc can start using the production
parsoid cluster directly.

Change-Id: I6649bede04c7bcc18eb81ee31f044b4ba4d976a2
Merge "Set permissive CORS headers in production"