Added comment about allowed origins

src/ApiGateways/Web.Bff.Shopping/aggregator/Program.cs

@@ -8,6 +8,7 @@ builder.Services.AddControllers();
 builder.Services.AddHealthChecks(builder.Configuration);
 builder.Services.AddCors(options =>
 {
+    // TODO: Read allowed origins from configuration
     options.AddPolicy("CorsPolicy",
         builder => builder
         .SetIsOriginAllowed((host) => true)