[SECURITY] Fix CORS misconfiguration - replace wildcard with specific origins

[grich88]

Security Fix: CORS Misconfiguration

This PR fixes a critical CORS misconfiguration that allows unauthorized cross-origin access to workflow APIs.

Changes:

• Replace \origin: '*'\ with specific allowed origins
• Add proper credentials handling
• Restrict exposed headers and methods
• Fix WebSocket CORS configuration

Security Impact:

• Before: Any website could access authenticated workflow APIs
• After: Only trusted origins can access APIs

Testing:

• Legitimate origins work correctly
• Malicious origins are blocked
• WebSocket connections maintained
• No breaking changes to existing functionality

Files Modified:

• \packages/backend/api/src/app/server.ts\ - Main CORS configuration
• \packages/backend/api/src/app/app.ts\ - WebSocket CORS configuration

Fixes: #313

[kolcompass]

Withdrawal Notice

I am withdrawing this pull request as it fixes a non-vulnerability.

Reason for Withdrawal:
The CORS configuration, while not ideal, is not exploitable due to browser security mechanisms that block wildcard origins with credentials.

Technical Details:

• Browser security prevents the described attack
• No real security impact to fix
• Fixing non-vulnerabilities is not valuable

Conclusion:
I will focus on finding and fixing real vulnerabilities instead.