Enable to configure CORS on embedded elasticsearch cluster

Since ES upgrade to 2.x (NXP-19194) it is not possible to use plugin like elasticsearch-head on a standalone Nuxeo instance (with Elasticsearch 2.3 embedded).
It was working with Nuxeo < 8.10 because the CORS are enabled (http.cors.enabled = true) but since Elasticsearch 2.x the default origin (http.cors.allow-origin) changes from ALL (*) to deny for security reason.

The result is that Elasticsearch embedded is always answering with 403.
The allow origin should be configurable and may be with a default like http://localhost:.*|file:.*.
–
It is now possible to use Elasticsearch tools to inspect (like elasticsearch-head) and query (like mirage) on Nuxeo index when Elasticsearch is embedded.