Is reflecting the CORS origin safe for a webhook?

## 💬 Question here

CORS is necessary because I need to send test requests from a browser (and a website I don't own). This is a bare-bones webhook that only supports `POST` & requires an `Authorization` header. Is it safe to reflect the request origin? I'm concerned because of a comment on the `@fastify/cors` readme:
```js
const corsOptions = {
// This is NOT recommended for production as it enables reflection exploits
origin: true
};
````

## Your Environment

- *node version*: 22
- *fastify version*: >=5.0.0
- *@fastify/cors version*: >= 11.0.0
- *os*: Linux