DOP-5513: allow requests from docs sites

[seungpark]

Ticket

DOP-5513

Notes

This PR adds middleware logic to the Express server so that we check the request origin, and append a Response Header for access-control-allow-origin to let the browser know that this is an ok CORS request.

Staging

Tested using the stage API with credentials included in the request:

First screenshot shows response.header missing Access-Control-Allow-Origin because it is from a random domain:

Second screenshot shows response.header with Access-Control-Allow-Origin because it is from a spoofed netlify.app domain:

Note:

• Above request had to contain Cookie request header to bypass CorSecure

README updates

• • This PR introduces changes that should be reflected in the README, and I have made those updates.
• • This PR does not introduce changes that should be reflected in the README

[seungpark]

Revert changes before merge