docs: warn about dangerous origin:true + credentials:true combination

[luisangelrod]

Summary

Adds targeted documentation warnings about the security risk of combining origin: true with credentials: true, plus a dynamic environment-based allowlist example requested during review.

When origin is true, the package reflects the browser's origin into Access-Control-Allow-Origin. Combined with Access-Control-Allow-Credentials: true, that can grant untrusted websites credentialed cross-origin access. The documentation now recommends an explicit allowlist and shows how to configure one without treating an unapproved origin as an application error.

Changes

• Add a cross-reference from the origin: true option to the credentials warning.
• Explain the risk and recommend an explicit allowlist.
• Add a dynamic ALLOWED_ORIGINS example using the package's origin callback.
• Return callback(null, false) for unapproved origins so the response simply omits CORS headers.

Validation

• npm test — ESLint and 49 tests passed with 100% coverage
• git diff --check
• Socket Security checks passed

Closes #422

[hiSandog]

The warning is clear. One small addition that might prevent copy-paste mistakes is showing the dynamic allowlist shape, not only the static array case, since many apps need env-specific or tenant-specific origins. A short origin: function (origin, callback) { ... } example near this warning would make the safer alternative concrete for users who originally reached for origin: true because their origin list was not static.