CORS should support multiple origins

[Baccata]

The current cors trait does not support providing a list of multiple allowed origins. See [https://github.com/awslabs/smithy/blob/main/smithy-model/src/main/java/software/amazon/smithy/model/traits/CorsTrait.java#L37].

This is limiting the implementation of Smithy-driven CORS-related middleware to a strict subset of what should be possible.

A change could probably be made in a backward compatible manner by deprecating the origin field of the trait in favour of an origins field that'd take a list of origins.