Add Access-Control-Allow-Origin header to responses, if not already present

[cicnavi]

Adding Access-Control-Allow-Origin header with value '*' will enable JS clients to get data from authn endpoints in cross-origin scenarios. This is in addition to already implemented CORS handling for 'userinfo' endpoint, which only allows registers origins for browser preflight CORS requests.

Fixes #189

[codecov[bot]]

Codecov Report

Base: 38.83% // Head: 38.78% // Decreases project coverage by -0.05% :warning:

Coverage data is based on head (b02ea09) compared to base (0948322). Patch coverage: 0.00% of modified lines in pull request are covered.

Additional details and impacted files

```diff @@ Coverage Diff @@ ## master #190 +/- ## ============================================ - Coverage 38.83% 38.78% -0.06% - Complexity 855 857 +2 ============================================ Files 105 105 Lines 2951 2955 +4 ============================================ Hits 1146 1146 - Misses 1805 1809 +4 ``` | [Impacted Files](https://codecov.io/gh/simplesamlphp/simplesamlphp-module-oidc/pull/190?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=simplesamlphp) | Coverage Δ | | |---|---|---| | [lib/Services/RoutingService.php](https://codecov.io/gh/simplesamlphp/simplesamlphp-module-oidc/pull/190/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=simplesamlphp#diff-bGliL1NlcnZpY2VzL1JvdXRpbmdTZXJ2aWNlLnBocA==) | `0.00% <0.00%> (ø)` | | Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=simplesamlphp). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=simplesamlphp)

:umbrella: View full report at Codecov.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.

[rmdashrfslash]

Hi - thanks for doing this. should the headers only be sent on approved origins that are registered in the client registry database, similar to how the userinfo endpoint does it?

[cicnavi]

I don't think so. For example, well-known should be (and is) available to anyone... 'userinfo' endpoint requires that a specific origin is returned in preflight request, so instead of '*', we return specific registered origin (https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#credentialed_requests_and_wildcards)