The "correct answer" is that administrators are expected to configure any endpoints that they need to use manually in a situation like this. This is a one time process, takes only a minute to complete, and is often used in packages that access salesforce.com servers. This is the best solution, because with the addition of "my domain" settings, there are nearly unlimited possible salesforce.com URLs, and you can't use wild cards.
That said, if you wanted to automate it, you could:
- Write a Flash script that performs the call, and embed it in a Visualforce page.
- Write a Java applet that performs the call, and embed it in a Visualforce page.
- Write a third-party server with known endpoint (embedded in the package), and callout to that known endpoint to perform the call.
- Write a Silverlight app that performs the call, and embed it in a Visualforce page.
As you can see, most solutions are probably over the top. Just have the administrator enable it once and forget about it.
In Apex Code, you can determine the correct endpoint by using
Url.getSalesforceBaseUrl() to make the Apex Code part dynamic.