set ACAO header to allow cross-origin access for public files

[bernhardreiter]

To allow browser based application to access the public files, the HTTP header Access-Control-Allow Origin: * must be set.

• document this requirement in the provider docs
• add the header to our nginx test setup example.

For more details see https://github.com/csaf-poc/csaf_webview/issues/15 and https://github.com/oasis-tcs/csaf/issues/653 .