CORS support

[XVincentX]

This PR installs the CORS middleware to the Prism instance when the --cors flag is enabled (which is enabled by default).

Docs and changeling added as well

Closes #412

[philsturgeon]

Reviewing on mobile so I might just have missed it but I couldn’t see a test that shows CORS actually working? A test harness to show tyre and false do things, and maybe some unit or integration with more specifics.

[XVincentX]

@philsturgeon See #412 — I added some comments there. We need to take a "product" decision before bringing this over the finish line.

[XVincentX]

@philsturgeon I've added two tests checking out the response, the headers and what happens if the CORS is disabled. Let me know if you want to test some particular scenarios.

[lag-of-death]

I think we need one more e2e test where both OPTIONS is defined in a spec and CORS is enabled (so that we can see that OPTIONS from spec is ignored).

[XVincentX]

I think we need one more e2e test where both OPTIONS is defined in a spec and CORS is enabled (so that we can see that OPTIONS from spec is ignored).

Very good point, I'll add one!

[philsturgeon]

if we are going to whitelist methods we should at least have all the ones OpenAPI supports.

Should we switch to method: '*' instead?

[XVincentX]

Unfortunately we cannot use * because otherwise the CORS plugin would complain (you need to leave the OPTIONS verb free); so I put all the other verbs that Fastify supports. Any other will make the framework scream at me.