`Cross-Origin-Resource-Policy` and `X-Content-Type-Options` HTTP headers

Need to figure out the right homes for these, see:

https://github.com/web-platform-dx/web-features/pull/2418#discussion_r1886353610

and

https://github.com/web-platform-dx/web-features/pull/2418#discussion_r1886362201