CORS: regex support for matching via allowedOriginsPatterns

Drupal core uses asm89/stack-cors for CORS matching; starting with version 1.2.0, asm89/stack-cors added support for using regex patterns to match against the origin header, by using the allowedOriginsPatterns configuration option.

Using allowedOriginsPatterns gives lots of flexibility for setting up CORS. A simple example is that projects running per-branch/per-ticket environments in sub-domains with a well-defined naming pattern, can now rely on a single rule to match any of those ephemeral environments:

allowedOriginsPatterns: ['#^http://[a-z1-9-]*\.mysite.com$#']

Will match for http://pr-123.mysite.com, but not http://longermysite.com.

default.services.yml files shipped with Drupal core now specify allowedOriginsPatterns, with no pattern at all (empty array); this is so that existing sites continue working the same, no matter if they still use the default allowedOrigins or they customized it to restrict access.