Support for credentialless iframes to address COEP header needs

if we see credentialless in the raw params, we should pass it along.

Discussed in https://github.com/quarto-dev/quarto-cli/discussions/4913

^{Originally posted by coatless March 21, 2023}
Right now, the video short code {{ video }} provides a standard iframe that automatically assumes the pages default headers.

https://github.com/quarto-dev/quarto-cli/blob/b0d668e4287f74f5208b510f37414a3341d7973b/src/resources/extensions/quarto/video/video.lua#L81

https://github.com/quarto-dev/quarto-cli/blob/b0d668e4287f74f5208b510f37414a3341d7973b/src/resources/extensions/quarto/video/video.lua#L108

https://github.com/quarto-dev/quarto-cli/blob/b0d668e4287f74f5208b510f37414a3341d7973b/src/resources/extensions/quarto/video/video.lua#L124

Would it be possible to have the short-code support or set by default a credentialless state? e.g.

<iframe credentialless src="https://example.com">

The credentialles state is important for Cross-Origin-Embedder-Policy
(COEP) environments. For webR startup and package installs, we need to set the COOP and COEP headers to significantly speed up the availability of in the browser R editor. We're running into issues with the iframe because when we turn on COEP, then any embedded lecture video from YouTube using the video shortcode is blocked with "youtube refused to connect."

By having the <iframe> tag include credentialless, the iframe is loaded from a different, empty context. In particular, it is loaded without cookies. This allows for the removal of the COEP restriction for just the video will allow the entire page to still fall under the custom COOP and COEP headers.

For more background, please see:

• Background on iframe-credentialless set: https://developer.chrome.com/blog/iframe-credentialless/
• Initial Proposal: https://github.com/camillelamy/explainers/blob/main/anonymous_iframes.md

Where the issue arose: https://github.com/coatless/quarto-webr/issues/8

Start in src/resources/extensions/quarto/video/video.lua at the linked iframe-generation lines and inspect how raw parameters are handled. Verify that a supplied credentialless parameter is reflected in the generated iframe output, then check the existing video shortcode behavior to confirm the change does not alter unrelated parameters.