docs: update security warnings around server.cors and server.allowedHosts
#19378
+18
−5
server.cors and server.allowedHosts
#19378