add cors headers to s3_success action

fixes CNVS-10678

test plan:
  * enable S3 uploads;
  * as any user, upload a profile picture while watching
    the network panel of your favorite browser;
  * verify that the s3_success action passes
    access-control-allow-* headers, including origin,
    methods, and headers.

Change-Id: I35ea81fc82fbf92a1410a6b896f96db79f1fc5c6
Reviewed-on: https://gerrit.instructure.com/28973
Reviewed-by: Braden Anderson <banderson@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Zach Pendleton <zachp@instructure.com>
QA-Review: Zach Pendleton <zachp@instructure.com>