[PORTSEA] Add CORS support for static assets

:koala: :tennis: :+1: 

Currently there are no headers that allow the assets to be loaded over XHR from the Zendesk domain. When the app is uploaded assets are served from the same domain so this is not a problem, however when running under `zat serve` it is using a different origin. 

This PR adds the Access-Control-Allow-Origin headers and others by using the sinatra-cross_origin gem to get around this issue.

/cc @zendesk/quokka