[Permissions Policy] Add support for Permissions-Policy-Report-Only and Reporting URL

The Permission Policy header is currently only active or absent. There is no mechanism to allow it to be used in a report only mode.

• Update the Permission Policy Settings so that the Permission Policy can either be:
  • Enabled
  • Enabled (Report Only)
  • Disabled
• Add a new setting for Permission Policy Report Uri
  • This should only allow valid URLs
  • Validation should include sending a test report to the endpoint to see if it returns a 200 response
• Update Header generation to conditionally output the permission policy header as either:
  • Permissions-Policy
  • Permissions-Policy-Report-Only
• Update Header generation to conditionally include the reporting definition
• Update the report-to header to include an additional group for the Permission-Policy reporting URI

See Discussion
See Specification

Start by locating the Permission Policy Settings and header-generation entry points, then read Discussion 380 and the linked Permissions-Policy-Report-Only specification. Implement the three policy states, reporting URI validation with a test request, conditional headers, and the additional report-to group; done means all requested settings and headers behave as described.