rgw: include str_list.h for ceph::for_each_substr in CORS header

get_multi_cors_method_flags() calls ceph::for_each_substr(), but
rgw_cors.h did not include str_list.h. The CORS unit test includes
only this header, so the build failed with an undeclared identifier.
Qualify the call and add the missing include.

Signed-off-by: ramin.najarbashi <ramin.najarbashi@gmail.com>