Move CORS protection to go-ipfs/core/corehttp

```
keks | lgierth: currently the CORS protection is in go-ipfs-cmds/http and wraps the actual handler. Wouldn't it make much more sense to make it a ServerOption in go-ipfs/core/corehttp?
lgierth | yeah
keks | I'm already moving the version check (https://github.com/ipfs/go-ipfs-cmds/blob/master/http/handler.go#L326) there to get rid of ipfs dependencies
lgierth | go for it
keks | alright
lgierth | and don't bother too much with the gateway, it's gonna be gone to its own repo soon
keks | alright 👍
```