Make CORS origins configurable

[matthewejones]

In the latest version of boardgame.io, the permitted origins must be provided.
At the moment this is set to the following in gameServer.js.

origins: [
    '*'
]

This would probably be better set up from a config file
This will also affect the deployment process

[ChristophNiehoff]

When setting up such a config file, one must not forget to also adapt the docker and heroku deployments.