feat(cors): add support for Access-Control-Expose-Headers about magento2-cors

This would be really cool. 👍

Got stuck with Apollo GraphQL at this because headers are not allowed.

const consoleLink = new ApolloLink((operation, forward) => {
    return forward(operation).map((data) => {
        const context = operation.getContext();
        const { response: { headers } } = context;
        if (headers) {
            const token = headers.get('x-session-token');

            if (token) {
                localStorage.setItem('token', token);
            }
        }
        return data;
    })
});

[damienwebdev]

@rasmuswikman I read through the spec. This should be fairly straightforward to implement. I'll submit a PR for you to try out.