http-cors: wildcards do not consider domain separation

[marcoreni]

Describe the bug
When adding an origin with wildcard, it's unclear why domains are not fully matched.

For example, if I add *.foo.com I would expect to match bar.foo.com but also my.bar.foo.com.

Instead, the Regexp used explicitly prevents . inside the wildcard: https://github.com/middyjs/middy/blob/main/packages/http-cors/index.js#L70C5-L70C77

This is not documented.

Expected behaviour

1. Document this behavior
   OR
2. Extend the regexp to include .

Additional context
Add any other context about the problem here.

[willfarrell]

This is actually by design as a security feature. This allows you more control over what you whitelist. You should be able to add *.foo.com and *.*.foo.com.