Allow same-origin fetches to potentially-trustworthy origins

[letitz]

HTTPS prevents DNS rebinding, which is the only reason we apply PNA checks to same-origin fetches.

If a fetch is made from a potentially-trustworthy origin to itself, then an attacker could only be attacking themselves. If an attacker obtains a certificate for the victim origin, then it's too late for us to do anything about it.

[letitz]

@johnathan79717 is looking into specifying this.