[openapi] Remove wildcard origins from the default CORS middleware

[chebykinn]

Right now we add CORS for wildcard headers and origins, we should be able to specify a whitelist of domains.