Add a note in the docs about `origin: true` and `credentials: true` being dangerous

We can't document all the ways to misconfigure CORS, but I think we can add a note about this particular combination somewhere near the `credentials: true` docs.

With `origin: true` and `credentials: true`, `cors` reflects any request Origin into `Access-Control-Allow-Origin` and sets `Access-Control-Allow-Credentials: true`, so a page on *any* origin can read responses to credentialed (cookie-bearing) requests. Because `Access-Control-Allow-Credentials: true` can't be combined with `Access-Control-Allow-Origin: *`, reflecting the origin is a common workaround that quietly opens this hole.

Perhaps in future versions we could choose to prevent such a configuration, but for now we can consider adding a note to the docs.

ref (closed, private) https://github.com/expressjs/cors/security/advisories/GHSA-8gfh-8qhq-hv6f

Start in the documentation section covering `credentials: true` and find the nearby CORS configuration guidance. Add a note explaining the risk of combining `origin: true` with `credentials: true`, then verify that the warning is clear and correctly describes credentialed requests from arbitrary origins.

Written by the indexing model from the issue text.