Feat/add cors environment variables

[MerlinTheWhiz]

Closes #372

Changes made:

• .env.example: Uncommented CORS_ORIGINS with default value http://localhost:3000,http://localhost:3001
• cors.config.ts: Removed hardcoded fallback origins, now uses empty array if env var not set
• security.config.ts: Fixed variable name from CORS_ORIGIN to CORS_ORIGINS for consistency
• websocket.gateway.ts: Removed hardcoded CORS fallback to match other config files

[drips-wave]

@MerlinTheWhiz Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits