Using the "extraHeaders" option can break CSS/JS/Resource loading, as the headers are included on all requests

### FAQ

- [x] Yes, my issue is not about [variability](https://github.com/GoogleChrome/lighthouse/blob/main/docs/variability.md) or [throttling](https://github.com/GoogleChrome/lighthouse/blob/main/docs/throttling.md).
- [x] Yes, my issue is not about a specific accessibility audit (file with [axe-core](https://github.com/dequelabs/axe-core) instead).
- [x] Yes, my issue is not answered by [other FAQs](https://github.com/GoogleChrome/lighthouse#faq).

### URL

https://www.epa.ie/who-we-are/gaeilge/an-sceim-teanga/

### What happened?

Some resources on the page are blocked due to a CORS error from allowed headers.

```json
{
"method": "Network.loadingFailed",
"params": {
"requestId": "7416.49",
"timestamp": 721073.514311,
"type": "Font",
"errorText": "net::ERR_FAILED",
"canceled": false,
"corsErrorStatus": {
"corsError": "HeaderDisallowedByPreflightResponse",
"failedParameter": "x-hide-preview-toolbar"
}
},
"targetType": "page",
"sessionId": "B88FA97ACC7C3B86A5265831AEA4C3FE"
},
```

`has been blocked by CORS policy: Request header field x-hide-preview-toolbar is not allowed by Access-Control-Allow-Headers in preflight response.`

### What did you expect?

Expected the header to only be added to my current page request rather than all subsequent requests.

### What have you tried?

Patching:
```js
if (headers) await session.sendCommand('Network.setExtraHTTPHeaders', { headers });
```
to:
```js
if (headers) {
// Use the Fetch protocol to only add headers to the main document requests.
await session.sendCommand('Fetch.enable', {
patterns: [{urlPattern: '*', resourceType: 'Document', requestStage: 'Request'}],
});
session.on('Fetch.requestPaused', async event => {
await session.sendCommand('Fetch.continueRequest', {
requestId: event.requestId,
// Merge the extra headers with the existing headers and ensure value is a string.
headers: Object.entries({...event.request.headers, ...headers}).map(([name, value]) => ({
name,
value: String(value),
})),
});
});
}
```

### How were you running Lighthouse?

node

### Lighthouse Version

12.8.1

### Chrome Version

139.0.7258.157

### Node Version

22.18.0

### OS

Windows

### Relevant log output

```sh

```

Start by tracing the `extraHeaders` option to the `session.sendCommand('Network.setExtraHTTPHeaders', { headers })` call. Check how request headers are applied to the main document and its resources, then verify that only the intended page request receives the headers and that dependent CSS, JavaScript, and font resources still load without CORS failures.

Written by the indexing model from the issue text.