Redesign CORS middleware implementation

[caiorcferreira]

This PR extends the CORS middleware to better cover the specification. The implementation presented here is highly inspired by the rs/cors package.

However, some modifications here made for restQL, most notably that the request handling implementation on rs/cors abort the execution when the origin, method, or request headers to be issued by the client are not allowed and we choose to not abort and return the appropriate headers if possible.

This decision is based on the CORS spec about how the Access-Control-Allow-Methods response header is handled, pointing that if it's not present, then the actual request method will be automatically authorized. Hence, aborting the CORS logic on the server because a method is not allowed cause it to be authorized. This is further reinforced by the lib authors here.

We choose to return all possible header, not only the ones related to methods because as pointed in this issue on the CORS spec repository, the enforcement point in on the client and the restQL as a server participating in the CORS protocol defer any blocking to its client by providing the maximum information possible about the authorized operations.

[jub0bs]

Related: whatwg/fetch#1588