Remove CORS allowed origins regex from prod config

[martijnvermaat]

config/prod.exs has allowed origins for our production systems hardcoded. We should make this configurable at runtime with an environment variable.

Perhaps the regex object can be created at runtime from a string?

Or we can update the CORS library to accept a simple domains with wildcards?

[dsnipe]

To implement this, we need to use an additional configuration plugin, something like: https://github.com/mrluc/deferred_config When I implement it, we could extract some variables to ENVs.