Document known mitigated security issue in `@koa/cors` for AS3 users
`@koa/cors` [recently published v5 with a CVE](https://github.com/koajs/cors/security/advisories/GHSA-qxrj-hx23-xp82). AS3 depends on `@koa/cors` but can't take the update for semver reasons, and the issue is already mitigated in all versions of AS3 so we don't really need to.

We should make a note of this somewhere in the docs to explain why this isn't a concern for users.