consider setting `cors.allow_any_origin = true` when run in `--dev` mode

[EverlastingBugstopper]

when running the router in --dev mode, whether through rover dev or otherwise, i may like to point a local front end application at the local router endpoint. unfortunately, this is not possible with the default --dev configuration - requests can only be made from embedded sandbox.

since we recommend folks not to run --dev in production environments, i think it should be OK to set cors.allow_any_origin = true when running in --dev mode to enable these development workflows.