Support multiple domains in CORS Request Handling Apicast Policy

Currently, ActiveDocs OAS3 requests are being blocked by CORS browsers security features.
Using CORS Request Handling Apicast Policy allows to enable CORS for a single domain. It is also possible to use a wildcard * to enable any domain, but that's insecure and we shouldn't ask clients to do that.
We need to enable CORS for multiple domains in order to be able to add both the Admin and the Dev Portal domains