Add option to enable a simple CORS implementation for the api server

Related to https://github.com/GoogleCloudPlatform/kubernetes/issues/1128
I think that instead of a binary flag, to avoid the issues with wildcarding, we should take a list of CORS domains.  No list, no CORS.  If an admin chooses to specify wildcard, that's their choice.  If they want to provide a list, then it's all in the same flag.  I struggle to justify adding more complexity to the config other than the three choices: "the domains that can enable CORS, nothing, or everything"