Add config setting for CORS header.

The response header Access-Control-Allow-Origin was always set to '*' for API
URLs. This is creating some problems with Apache (see
https://github.com/openstreetmap/iD/issues/2333), so it is now configurable.
The value of the new config setting "instance.access_control_allow_origin" is
used for that header now, or, if the variable is empty, the header is not set
at all.