Add a comment why we allow all origins for our public JSON API

app/classes/ReleaseInsights/Json.php

@@ -33,7 +33,7 @@ public function output(): string
         }
 
         ob_start();
-        header("access-control-allow-origin: *");
+        header("access-control-allow-origin: *"); // * is OK as our Json API is public and readonly
         header("Content-type: {$mime}; charset=UTF-8");
         header("Content-Length: " . strlen($json));
         echo $json;