Feat: (API Gateway) Globals Api Cors should allow headers as well

**Description:**
When I use
```yaml
Globals:
Function:
Timeout: 30
Api:
EndpointConfiguration: REGIONAL
Cors: "'*'"
Auth:
DefaultAuthorizer: MyLambdaRequestAuthorizer
Authorizers:
MyLambdaRequestAuthorizer:
FunctionPayloadType: REQUEST
FunctionArn: !GetAtt AuthorizerFunction.Arn
Identity:
Headers:
- Authorization
ReauthorizeEvery: 100 # seconds
```

The headers for `Access-Control-Allow-Origin` and `Access-Control-Allow-Methods` are added to the swagger doc for the preflight OPTIONS requests, but headers for `Access-Control-Allow-Headers` are not added. This is a blocker for Twitch extensions because they send signed JWTs in a header named `Authorization` so Twitch Extension authors are forced to define their entire API via swagger.

Even when using a Lambda Authorizer and specifying an `Authorization` header, the requests are rejected because `Authorization` isn't included in an `Access-Control-Allow-Headers` header. I end up having to specify the whole swagger document myself, which makes SAM's API generation feature significantly less useful.

**Steps to reproduce the issue:**
1. `sam init ....`
2. add the `api` description shown above
3. deploy the template
4. Attempt to send a request to the deployed api with an Authorization header

**Observed result:**
"Authorization" is not listed in `Access-Control-Allow-Headers` and the request is blocked.

**Expected result:**
```
{
statusCode: 200,
body: "GREAT SUCCESS!!!!"
}
```