OOR-CORS: Disable kStrictAccessControlAllowListCheck for M84

To reduce risks for launching OOR-CORS on WebView 83/84, we temporarily
disable the kStrictAccessControlAllowListCheck for M84.

Once this patch is merged to the M84 branch, I will quickly revert this
for M85.

Bug: 1084376
Change-Id: I2256eed511ea995bad91b611f976d72eb228443b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2206861
Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org>
Commit-Queue: Kinuko Yasuda <kinuko@chromium.org>
Auto-Submit: Takashi Toyoshima <toyoshim@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#770000}

services/network/public/cpp/features.cc

@@ -198,7 +198,7 @@ const char kCorbAllowlistAlsoAppliesToOorCorsParamName[] =
 // existing sites might fail to load. The feature flag controls whether a strict
 // check will be used or not.
 const base::Feature kStrictAccessControlAllowListCheck = {
-    "StrictAccessControlAllowListCheck", base::FEATURE_ENABLED_BY_DEFAULT};
+    "StrictAccessControlAllowListCheck", base::FEATURE_DISABLED_BY_DEFAULT};
 
 // Enables preprocessing requests with the Trust Tokens API Fetch flags set,
 // and handling their responses, according to the protocol.

third_party/blink/web_tests/external/wpt/fetch/api/cors/cors-preflight-response-validation.any-expected.txt

+This is a testharness.js-based test.
+FAIL Preflight response with a bad Access-Control-Allow-Headers assert_unreached: Should have rejected: undefined Reached unreachable code
+FAIL Preflight response with a bad Access-Control-Allow-Methods assert_unreached: Should have rejected: undefined Reached unreachable code
+Harness: the test ran to completion.
+

third_party/blink/web_tests/external/wpt/fetch/api/cors/cors-preflight-response-validation.any.worker-expected.txt

+This is a testharness.js-based test.
+FAIL Preflight response with a bad Access-Control-Allow-Headers assert_unreached: Should have rejected: undefined Reached unreachable code
+FAIL Preflight response with a bad Access-Control-Allow-Methods assert_unreached: Should have rejected: undefined Reached unreachable code
+Harness: the test ran to completion.
+