Sync subscription CORS configuration

[mthenw]

This is a Feature Proposal

Right now the event gateway allows all methods, headers, origins

event-gateway/api/events.go

Lines 21 to 26 in a65df4e

	handler := &http.Server{
	Addr: ":" + strconv.Itoa(int(config.Port)),
	Handler: cors.AllowAll().Handler(router),
	ReadTimeout: 3 * time.Second,
	WriteTimeout: 3 * time.Second,
	}

CORS configuration should be per HTTP subscription. HTTP subscription should allow specifying additional cors field with the following structure (and default values):

{
  "cors": {
    "origins": [], // default "*"
    "methods": [], // default ["GET", "POST"]
    "headers": [],  // default ["Content-Type", "Authorization"]
    "allowCredentials": false // default "false"
  }
}

origins is an array but actually, it should return only matched origin in the request. See #16.

Similar or dependent issues:

• Support multiple CORS origins for sync subscriptions #16
• Review CORS configuration for both Config and Events API #309