FR: Enable Proper CORS Handling for CDN & Update Docs to Show Proper Tags with Subresource Integrity

### [REQUIRED] Describe your environment

* Operating System version: macOS 10.13.3
* Firebase SDK version: 4.8.1
* Firebase Product: N/A (auth, database, storage, etc)

### [REQUIRED] Describe the problem

#### Steps to reproduce:
1. For example, in an HTML script tag using the `crossorigin="anonymous"` attribute, make a request for one of the CDN-hosted Firebase JS files:
```html

```
2. Regardless of the host from which you're making the request (localhost, example.com, etc.), Chrome or any other browser with a CORS implementation will block the resource because gstatic.com's responses lack an `Access-Control-Allow-Origin: *` header.
3. This also disallows the use of hashes for Subresource Integrity checks, as CORS is a precondition.
4. If you're fine with passing up the security benefits of CORS and Subresource Integrity, you can avoid the errors by simply writing the script tag without the `crossorigin` attribute, but I would request that Firebase/Google make this a priority and update the docs to show usage with `crossorigin` and `integrity` attributes.

#### Relevant Code:

Here's a sample response from gstatic.com for a request made to https://www.gstatic.com/firebasejs/4.8.1/firebase-app.js:
```http
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 654555
Alt-Svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
Cache-Control: public, max-age=31536000
Content-Encoding: gzip
Content-Length: 9475
Content-Type: text/javascript; charset=UTF-8
Date: Wed, 20 Dec 2017 19:52:07 GMT
Expires: Thu, 20 Dec 2018 19:52:07 GMT
Last-Modified: Tue, 19 Dec 2017 01:02:49 GMT
Server: sffe
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
```