Be more accurate about cross-origin protections

### MDN URL

https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API

### What specific section or headline is this issue about?

_No response_

### What information was incorrect, unhelpful, or incomplete?

- Timing-Allow-Origin is needed for CORS and no-cors, it's for cross-origin protection
- In the case of cross-origin iframes, responseEnd might measure when the iframe finished loading completely with all its subresources, not just the main resource.
- encoded/decoded body size are (soon to be) CORS-protected rather than TAO protected

### What did you expect to see?

See above

### Do you have any supporting links, references, or citations?

_No response_

### Do you have anything more you want to share?

_No response_

### MDN metadata

Page report details

* Folder: `en-us/web/api/resource_timing_api`
* MDN URL: https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API
* GitHub URL: https://github.com/mdn/content/blob/main/files/en-us/web/api/resource_timing_api/index.md
* Last commit: https://github.com/mdn/content/commit/66c9543af6a0cf1baf89d5b0c972ee7dd08663b0
* Document last modified: 2022-11-05T00:48:48.000Z