[keyserver] Allow localhost CORS origin in development

Summary:
When developing web in localhost, I'm running http://localhost:3000/comm in browser, but the web app reaches keyserver using IP address: http://xx.xx.xx.xx:3000 so e.g. uploaded media are fetched with the following URI: http://IP_ADDR:3000/comm/upload/86797/7f9059dc4458e215

This works for <img src="uri"> but not for fetch() (used for encrypted media) where it fails with CORS error: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin http://localhost:3000 is therefore not allowed access.

Added CORS header for development only that adds localhost to allowed origins. This affects only the upload endpoint.

This shouldn't affect production, as it is the same origin: web.comm.app

Test Plan: CORS requests no longer fail when downloading resources using fetch()

Reviewers: atul, ashoat

Reviewed By: atul

Subscribers: tomek

Differential Revision: https://phab.comm.dev/D7249