assets: PreloadHTML font preloads cannot be reused by CSS font fetches

[linkdata]

Problem

assets.PreloadHTML emits font URLs without a CORS setting:

html, _ := assets.PreloadHTML(&url.URL{Path: "font.woff2"})
fmt.Print(html)

Output:

<link rel="preload" href="font.woff2" as="font" type="font/woff2">

Without crossorigin, the preload uses the no-CORS state. CSS @font-face fetching uses anonymous CORS mode, while a preload key includes request destination, mode, and credentials. The CSS font consumer therefore cannot consume this preload entry.

See the HTML CORS settings, preload algorithm, and CSS font fetching requirements.

The font still loads normally. The impact is a lost preload optimization and a possible redundant request or transfer, not broken rendering or a guaranteed double download.

Proposed fix

Add an anonymous CORS setting—crossorigin or crossorigin="anonymous"—to generated font preload links.

Acceptance criteria

• MIME-recognized font preloads include as="font", their MIME type, and anonymous crossorigin.
• Add a platform-independent test using a distinct registered font/* MIME extension.
• Query-string escaping and existing image/font classification behavior remain covered.
• Tests do not claim or depend on a guaranteed network-request count.