Update `@koa/cors` dependency for AS3 (or why we don't intend to)
### Issue Description

This issue exists for information discovery purposes.

Apollo Server 3 depends on `@koa/cors@4` which just [published a major version with a CVE](https://github.com/koajs/cors/security/advisories/GHSA-qxrj-hx23-xp82). Unfortunately, `@koa/cors@5` drops support for Node 12, which AS3 supports, so this is a breaking change for us.

Additionally, this issue has been mitigated for all Apollo Server 3 versions based on our usage of the package, so this is not a concern for our users. The `@koa/cors` v5 update sets the default usage of the package to `origin: '*'`, but Apollo Server already uses the package in this manner (unless the user provides a different configuration themselves, in which case this becomes a userland concern): 
https://github.com/apollographql/apollo-server/blob/09d313768079ccdd27d31b43321178955191184d/packages/apollo-server-koa/src/ApolloServer.ts#L100-L109

If you're here due to a security scanner report, we recommend either configuring your tool to filter this vuln or updating to AS4. (Neither AS4 itself (`@apollo/server`) nor its community-maintained Koa integration `@as-integrations/koa` has a dependency on `@koa/cors`.)

### Link to Reproduction

n/a

### Reproduction Steps

_No response_