Replace 3rd party libraries with proxied/CORS HTTP API requests

[digitarald]

Captured concern from the firefox-dev thread, to only have 1st party trusted scripts in the page at all times.

We need to review how feasible a server component is for perf.html (possibly while moving to a Mozilla-supported hosting infrastructure). CORS would be a possible fallback but still leak the user's IP.

• [x] #645 bit.ly CORS
• [ ] GA CORS (aka Measurement Protocol)
• [ ] Proxy all HTTP APIs to not call 3rd party services directly

┆Issue is synchronized with this Jira Task