CROSSORIGIN and CREDENTIALS on prefetch requests

[giorgiopellegrino]

Dear @addyosmani @XhmikosR ,

I am submitting this pull request to address issues encountered within our Luxottica e-commerce group, where we observed inconsistent resource prefetching behavior across different browsers.

Currently, three prefetching methods are implemented:

1. viaDom – Prefetches resources without checking the Access-Control-Allow-Origin header, using the attribute crossorigin="anonymous".
2. viaXhr – Fetches resources while always validating the Access-Control-Allow-Credentials response header.
3. viaFetch – Executes a fetch request that defaults to mode: "cors" and checks Access-Control-Allow-Origin, while credentials: "include" ensures Access-Control-Allow-Credentials validation.
   Additionally, I have handled resource prioritization for Safari devices, adding the priority: "low|high" property specifically for fetch requests. All parameters are set to false by default but can be adjusted as needed.

The updated method signature for prefetching is as follows:

prefetch(url, isPriority, checkAccessControlAllowOrigin, checkAccessControlAllowCredentials);

window.addEventListener('load', () => {
  quicklink.listen({el, priority,
                    checkAccessControlAllowOrigin, checkAccessControlAllowCredentials});
});

I would appreciate your review of these improvements.

Thank you,
Giorgio

c.c. @gilbertococchi