v2: CORS issues when reducing permissions

As seen in #100, but also happens when trying to render gitlab pages, the combination of (1) an extension page and (2) not having full host privileges, can cause the extension page to fail to fetch the markdown:

E.g. opening `ext+view-markdown:https://gitlab.com/gitlab-org/gitlab-foss/-/raw/master/doc/install/requirements.md`
This causes the following error, followed by a link to [this docs page](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSMissingAllowOrigin):

> Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://gitlab.com/gitlab-org/gitlab-foss/-/raw/master/doc/install/requirements.md. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.

Here are the headers for that page:
```
https://gitlab.com/gitlab-org/gitlab-foss/-/raw/master/doc/install/requirements.md
Host: gitlab.com
User-Agent:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie:
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
GET: HTTP/2.0 304 Not Modified
date: Sun, 29 Jan 2023 18:29:16 GMT
cache-control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60
content-disposition: inline
content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://content.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://content-cloudresourcemanager.googleapis.com https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com snowplow.trx.gitlab.net; default-src 'self'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://content.googleapis.com https://content-cloudresourcemanager.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://*.codesandbox.io https://customers.gitlab.com https://*.zuora.com/apps/PublicHostedPageLite.do; img-src * data: blob:; manifest-src 'self'; media-src 'self' data: http: https:; object-src 'none'; report-uri https://sentry.gitlab.net/api/105/security/?sentry_key=a42ea3adc19140d9a6424906e12fba86; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-TkcXd3d4quEYg7ChmKQ4IQ=='; style-src 'self' 'unsafe-inline'; worker-src https://gitlab.com blob: data:; form-action 'self' https: http: http:
etag: ""
permissions-policy: interest-cohort=()
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id:
x-runtime: 0.131158
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
gitlab-lb: fe-30-lb-gprd
gitlab-sv: web-gke-us-east1-b
cf-cache-status: HIT
age: 12
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bnt6muaiTZWkJxndIP82FcM3OHoClJbIxFkbqt4xDBLtDpYHwSJMZExV5kgOjcZyibqewwlP168MYXZNukFfGF3lcMe9vzgK1BjB3vMvSdY%2Fo%2FeD1ggNWgjGif5Qn1s2Zlohc8J2nGw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
strict-transport-security: max-age=31536000
server: cloudflare
cf-ray: 791408493bf9dcbb-LHR
X-Firefox-Spdy: h2
```

This doesn’t happen when keeping all permissions, or when injecting into the page (i.e. without redirecting to an extension page) from the navigation bar button, because in both cases we have host permissions.

Reproduce the ext+view-markdown GitLab URL with reduced permissions, then compare it with the full-permissions and navigation-bar injection cases described in the issue. Trace the extension-page fetch path and permissions involved; done means the GitLab markdown renders successfully without granting full host privileges.

Written by the indexing model from the issue text.