Add missing documentation for cors policy config

[fb-smit]

We are missing some docs for how to configure the cors policy in the appsettings

CorsPolicy:
  Origins:
    - "http://localhost:4200"
    - "http://localhost:4201"
  ExposedHeaders:
    - "x-custom-header"
  Methods:
    - "POST"
  SupportsCredentials: "true"

Docs from MS:
https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.cors.infrastructure.corspolicy?view=aspnetcore-8.0
https://learn.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-8.0