Define Access-Control-Allow-Origin for CSS for assets.

Summary:
To be sure the assets site serves the expected file, we can use the SRI,
Subresource Integrity mechanism to store a hash in the <link> tag.

If the URL does not support Cross-Origin Resource Sharing (CORS),
the SRI mechanism can't work. We so allow access from all origins.

Reference: https://www.w3.org/TR/SRI/

Ref T1881

Test Plan: Tested with D3119 to load D3135 CSS

Reviewers: dereckson

Reviewed By: dereckson

Maniphest Tasks: T1881

Differential Revision: https://devcentral.nasqueron.org/D3136