docs(security): add documentation around why the "*" should generally be recommended against.

[damienwebdev]

Currently, we recommend against using the wildcard access-control-allow-origin header, we should explain precisely why.