Add references to From-Origin and Isolate-Me as potential opt-in mechanisms

Bug: 806996
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_mojo
Change-Id: I5ffa57b0a4231917e3d3a227cb986c8f5a5f3827
Reviewed-on: https://chromium-review.googlesource.com/996313Reviewed-by: Nick Carter <nick@chromium.org>
Reviewed-by: Charlie Reis <creis@chromium.org>
Commit-Queue: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#548205}

services/network/cross_origin_read_blocking_explainer.md

@@ -682,8 +682,9 @@ In the future CORB may be extended to protect additional resources as follows:
   This would make it possible to CORB-protect resources like
   images or JavaScript (including JSONP).
 
-> [lukasza@chromium.org] TODO: Is there an existing HTTP response header
-> that may be used in this context?
+> [lukasza@chromium.org] Currently considered CORB opt-in signals include:
+> - `From-Origin:` header - https://github.com/whatwg/fetch/issues/687
+> - `Isolate-Me` header - https://github.com/WICG/isolation
 
 ## Appendix: Early attempt to codify CORB algorithm