Add Access Control, CORS (Cross Origin Request Sharing) header methods

[pgjones]

This should make it a little easier to get and set access control headers as it ensures the types and naming is correct. It is also intentionally very minimal like the other header accessors.

closes #131

[davidism]

Similar to the CSP implementation, I'm wondering if we should have a single access_control property that returns an AccessControl object instead. Or maybe we need some sort of equivalent to EtagMixin.make_conditional that adjusts the response based on the request, since that's where the complexity lies.

I checked out Flask-CORS, somewhat discouraging to see that they're using str.split instead of the Werkzeug header parsing utilities already. While I'm fine with adding the header properties, I'm not sure how useful on its own that will be.

[pgjones]

I went for a single access_control property and object in Quart, however I don't think it is the right decision as it isn't consistent with how I think Werkzeug works (headers are only combined within a wrapper object, including CSP which is a single header) and the AccessControl instance itself isn't very useful on its own (Quart usage is always [wrapper].access_control.[header]).

The correct header parsing and setting is in itself useful (in my view). Whilst I like something like make_cors, I don't think it fits with Werkzeug. I think make_conditional is possible using the information in the wrappers alone whereas cors needs some application decisions/inputs.