Allow to pass multiple origins for cross site requests

[Lubosky]

📝 A short description of the changes

Allow to specify multiple originc via ENV variable CORS_HOST.

🔗 Link to the relevant story (or stories)

Asana card: none

Deployment implications

None

✅ Checklist

• Features that cannot go live are behind a feature flag/env var or specify deploy date and open PR as draft
• I have checked that commit messages make sense and explain the reasoning for each change
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I have squashed any unnecessary or part-finished commits

🖼️ Screenshots (if appropriate - no PII/Prod data):