Add CORP+COEP functionality

[empijei]

CORP

Cross-Origin-Resource-Policy needs to be set to same-origin on all responses that are not protected by the CORS plugin (those should get a cross-origin value instead).

There should be an opt-out that sets cross-origin.

It should also support reporting.

COEP

There should be a way to enable COEP.

More info here: https://web.dev/coop-coep/