Ability to turn off CORS headers

[jmartisk]

At the moment the metrics endpoint always appends CORS headers. However, in Quarkus, we want to use the general CORS filter provided by Quarkus, so SR-M should not append these headers by itself.
With this change, there will be a option to turn headers off. For better backward compatibility, the default will remain "on".
See quarkusio/quarkus#14430