Update Access-Control-Allow-Origin to include subdomains

[Matthew-Grayson]

🗣 Description

Updates express cors origin option to account for crossfeed subdomains such as staging-cd.crossfeed.cyber.dhs.gov/ [/crossfeed\.cyber\.dhs\.gov$/, /localhost$/] -> [/.*crossfeed\.cyber\.dhs\.gov$/, /localhost$/]

💭 Motivation and context

the /organizations endpoint fails with a 502 status (internal server error

🧪 Testing

✅ Pre-approval checklist

• [x] This PR has an informative and human-readable title.
• [x] Changes are limited to a single goal - eschew scope creep!
• [x] All future TODOs are captured in issues, which are referenced in code comments.
• [x] All relevant type-of-change labels have been added.
• [x] I have read the CONTRIBUTING document.
• [x] These code changes follow cisagov code standards.
• [x] All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
• [x] Tests have been added and/or modified to cover the changes in this PR.
• [x] All new and existing tests pass.

✅ Pre-merge checklist

• [ ] Revert dependencies to default branches.
• [ ] Finalize version.

✅ Post-merge checklist

• [ ] Create a release.