Refactor our handling of CORS

Previously we have relied on developers to either use `JsonComponent` or `Cors` to generate the correct `Result` object with appropriate cors headers such as `Access-Control-Allow-Origin` applied. This was an explicit action that has resulted in certain responses such as 40x or 50x not having CORS headers applied or sometime forgetting to add them.

This ensures that cors is always implicit if the request was json, and applied them at a filter level, ensuring they will never be forgotten.

For some context, we have reason to believe this may be causing some of issues loading comments. And are applying these headers globally to help us diagnose the issue in more depth.

See these Sentry errors for more detail:
http://frontend.errors.gutools.co.uk/guardian/frontend/group/5968/

/cc @gklopper @rich-nguyen @jamesgorrie