[web-api] Deprecate cross-origin Module sharing

Currently, modules can be serialized and shared with other context in the same agent cluster (see spec here). Agent clusters are scoped to sites instead of origins by default, which means that modules can be shared with a same-site but cross-origin contexts. To improve mitigations against attacks like Spectre, we are aiming to make agent clusters scoped to origins instead. To do this we must deprecate document.domain (see plan) and sharing of WASM modules cross-origin. The latter is used by 0.06% of web pages at best according to our metrics, so we could proceed with deprecation right away. The plan would be to store the origin as well as the agent cluster in the serialization step, and to check it when passing the module.

Start with the WebAssembly Web API serialization section linked in the issue and review the deprecating-document.domain plan. Determine how the origin should be stored and checked alongside the agent cluster; done means cross-origin module sharing is deprecated in the specification.