Blink manages an origin whitelist to bypass CORS checks for Chrome Extensions and exposes API to the extension module, as WebSecurityPolicy::AddOriginAccessWhitelistEntry, and so on.

To support OOR-CORS, we need to move the whitelist to services/network.

See also https://docs.google.com/document/d/1JNmUcvbw2UcjfdI2uyUpveHXCbae-DQ1n8d_sVs5fLg/edit#heading=h.jxtgloyms3ey