Define how CORP and COEP should work for subresource loading

[hayatoito]

• CORP: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP)
• COEP: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy

We need to figure out how CORP and COEP should work for Subresource loading with WebBundles.

Chromium side issue is here.

[hayatoito]

Let me start to figure out what is a desired behavior at pretty high level, as a starting point of a discussion.

For the bundle:

CORP and COEP are irrelevant because a browser always use CORS to fetch the bundle.

For the resources within the bundle:

A browser must check a response header of a resource in a bundle.
e.g. The resources within the bundle need "Cross-Origin-Resource-Policy: cross-origin" response header if they are intended for the cross-origin page which has "Cross-Origin-Embedder-Policy: require-corp", and so on.

[ghost]

Related in whatwg/html
Proposal: Deprecation of "cross-origin-policy" in favor of a declarative network isolation of insecure HTML tags (#6553)

[irori]

For the bundle:

CORP and COEP are irrelevant because a browser always use CORS to fetch the bundle.

For the resources within the bundle:

A browser must check a response header of a resource in a bundle.
e.g. The resources within the bundle need "Cross-Origin-Resource-Policy: cross-origin" response header if they are intended for the cross-origin page which has "Cross-Origin-Embedder-Policy: require-corp", and so on.

I think these are reasonable. Created #684.