feat(runtime): add CORS headers to OPTIONS requests to assets

[philnash]

Fixes #107.

I checked and when you make an OPTIONS request to an asset you get these CORS headers:

access-control-allow-origin: *
access-control-allow-headers: Accept, Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: ETag
access-control-max-age: 86400
access-control-allow-credentials: true

But you don't get those headers for other requests.

Contributing to Twilio

All third-party contributors acknowledge that any contributions they provide will be made under the same open-source license that the open-source project is provided under.

• I acknowledge that all my contributions will be made under the project's license.