Allow a more flexible AllowOrigin response

[mharthoorn]

Instead of the CorsService peeking into the CorsPolicy

   policy.Origins.Contains(origin)

A method OriginAllowed(string origin) would allow for a much more flexible lookup policy. The service would then call:

  policy.OriginAllowed(origin)

This allows the policy to respond with a more ad hoc response like a (database) lookup.
The default would simply be:

        public virtual bool OriginAllowed(string origin)
        {
            return this.Origins.Contains(origin);
        }

But an override policy could become something like:

        public override bool OriginAllowed(string origin)
        {
            return repository.Exists<Sites>(s => s.Origin == origin);
        }

[Choc13]

See issue #75

[Eilon]

We will consider this for the next version.

[aspnet-hello]

This issue was moved to dotnet/aspnetcore#2379