Adding CORS support in responses

This is the API preparation to get rid of apache mod_proxy definitions in our MAP application. This only makes sense if the corresponding PR (https://github.com/geoadmin/mf-geoadmin3/pull/1508) in ga3 will be merged.