fix: Use instance origin for waiting forms and webhooks CORS headers instead of wildcard

fix: Use instance origin for waiting forms and webhooks CORS headers instead of wildcard #4330