Support for CORS COEP COOP CORP CORB (cross-origin isolation)

We have support for traditional CORS (i.e. preflight request). After the introduction of CORB, the server can include Content-Type, `X-Content-Type-Options: nosniff` and ACAO in the response to let the browser run the CORB algorithm.

[COEP](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy) allows a site to mandate CORS or CORP from the resource origin.

[COOP](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy) configures the browsing context.

[CORP](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy) specify whether a resource can be loaded cross-origin.

They together enable cross-origin isolation, which is essential to enable features like ShareArrayBuffer.

Start by researching how the server handles HTTP response headers and the linked COEP, COOP, and CORP specifications. Define the supported behavior for cross-origin isolation, including CORB-related Content-Type, X-Content-Type-Options, and ACAO responses, before identifying the relevant implementation and tests.

Written by the indexing model from the issue text.