GitLab

After r606352, default URLLoaderFactory does not make any CORB
exceptions for extensions and/or apps.  Separate URLLoaderFactories
(relaxing CORB) need to be created for content scripts.

One scenario, where separate URLLoaderFactories should be created, is
content scripts injected into <webview> tag.  Such scripts execute
fetches with |request_initiator| set to the origin of the <webview>
embedder and so permissions of the embedder need to be taken into
account (e.g. a Chrome App might be able to make cross-origin requests).

This CL adds a regression test for this scenario (without product code
changes the new test fails with --enable-features=NetworkService flag)
and fixes the product code to trigger creation of separate
URLLoaderFactory when needed.

For an overview of separate URLLoaderFactories for extensions, see
https://docs.google.com/document/d/1fuBUmLZj1H319jMkK8waUbf5WdQS0N95J_mWXVzbP7A

Bug: 846346
Change-Id: I6ac0f42df7562a01c14cbe6740417b6d94b51810
Reviewed-on: https://chromium-review.googlesource.com/c/1337822
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#608859}