Make interceptor plugins consistent

[empijei]

As of today interceptors default are constructed in various different ways:

• NewPlugin for fetchmetadata
• Default for coop and csp
• Just an Interceptor literal for staticheaders
• A pointer Interceptor literal for xsrfhtml
• hostcheck doesn't have a concept of Default because it requires the user to specify a value
• BUT cors has a Default interceptor that requires the allowed orgins to be constructed.

All of this is quite confusing.