[CORS] Old library makes exploitable CORS configuration (need to update dependency)

#### Version information:

master

#### Type:

Bug

#### Description:

When `Access-Control-Allow-Origin` is set to `*` (think this is the default), the CORS library we use automatically sets it to the value of the `Origin` header of the request. However we also set or recommend to set `Access-Control-Allow-Credentials: true` (not sure why).

The result is that this is going around a browser security feature where `Access-Control-Allow-Credentials: true` is not allowed when `Allow-Origin: *`. The library we use for that patched this behaviour and we should upgrade accordingly.

More info: https://github.com/rs/cors#allow--with-credentials-security-protection (and linked issues and linked discussions from those issues).

Also, since the go-ipfs APIs have nothing with credentials, cookies etc, I'm not sure why `Access-Control-Allow-Credentials: true` is there (and the documentation invites the user to configure it at least - web UI too). There's probably a reason so I'd love to know (cc. @olizilla, @lidel)

Also not clear why `Access-Control-Allow-Headers: X-Stream-Output, X-Chunked-Output, X-Content-Length` is hardcoded, since probably (?) these headers are not relevant as part of requests made against the API (only responses, that's why `Expose-Headers` is set as well), but I might be wrong.