Add CORS policy to APIcast

CORS is not available as an OOTB policy in APIcast. There is already a list of OOTB policies being tracked internally and prioritised. The purpose of this issue is to track the progress of this specific feature and to increase the priority/urgency due to the issue this creates for all current on-premise customers.

The issue here is that ActiveDocs cannot be used securely. The most common approach is that the documentation will point to the gateway like all production traffic and therefore CORS would need to be added as a customisation to the gateway.