Security: Review and restrict CORS configuration in notification preferences routes

## Background
The notification preferences routes currently use a permissive CORS configuration that allows all origins (`Access-Control-Allow-Origin: "*"`). This configuration was identified during code review of PR #4204.

## Security Concern
In a production environment, allowing all origins to access the API can pose security risks, potentially enabling malicious websites to make cross-origin requests to the API.

## Suggested Solution
- Replace the wildcard (`*`) with a whitelist of trusted domains
- Configure CORS settings based on the environment (development/production)
- Consider using environment variables to manage allowed origins

## References
- Original PR: https://github.com/airqo-platform/AirQo-api/pull/4204
- Review Comment: https://github.com/airqo-platform/AirQo-api/pull/4204#discussion_r1921239198

cc @Baalmart