Deflake external/wpt/fetch/sec-metadata/xslt tests.

The tests in //fetch/sec-metadata use the server-side stash, but don't
do so with unique-enough identifiers. This patch adds a nonce to the
stash key used by the XSLT test.

Bug: 947023
Change-Id: I4962c90d43a0bb9b55a2ec3a4160eb33de6105c9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1706503
Reviewed-by: Andy Paicu <andypaicu@chromium.org>
Commit-Queue: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#679014}

fetch/sec-metadata/resources/xslt-test.sub.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<?xml-stylesheet href="https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=xslt-same-origin" type="text/xsl" ?>
-<?xml-stylesheet href="https://{{hosts[][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=xslt-same-site" type="text/xsl" ?>
-<?xml-stylesheet href="https://{{hosts[alt][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=xslt-cross-site" type="text/xsl" ?>
+<?xml-stylesheet href="https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=xslt-same-origin{{GET[token]}}" type="text/xsl" ?>
+<?xml-stylesheet href="https://{{hosts[][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=xslt-same-site{{GET[token]}}" type="text/xsl" ?>
+<?xml-stylesheet href="https://{{hosts[alt][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=xslt-cross-site{{GET[token]}}" type="text/xsl" ?>
 
 <!-- postMessage parent back when the resources are loaded -->
 <script xmlns="http://www.w3.org/1999/xhtml"><![CDATA[

fetch/sec-metadata/xslt.tentative.https.sub.html

@@ -4,30 +4,32 @@
 <script src=/resources/testharness.js></script>
 <script src=/resources/testharnessreport.js></script>
 <script src=/fetch/sec-metadata/resources/helper.js></script>
+<script src=/common/utils.js></script>
 <script>
   // Open a window with XML document which loads resources via <?xml-stylesheet/> tag
-  let w = window.open("resources/xslt-test.sub.xml");
+  let nonce = token();
+  let w = window.open("resources/xslt-test.sub.xml?token=" + nonce);
   window.addEventListener('message', function(e) {
     if (e.source != w)
       return;
 
     promise_test(t => {
       let expected = {"dest":"xslt", "site":"same-origin", "user":"", "mode": "same-origin"};
-      return fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=xslt-same-origin")
+      return fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=xslt-same-origin" + nonce)
           .then(response => response.text())
           .then(text => assert_header_equals(text, expected));
     }, "Same-Origin xslt");
 
     promise_test(t => {
       let expected = {"dest":"xslt", "site":"same-site", "user":"", "mode": "no-cors"};
-      return fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=xslt-same-site")
+      return fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=xslt-same-site" + nonce)
           .then(response => response.text())
           .then(text => assert_header_equals(text, expected));
     }, "Same-site xslt");
 
     promise_test(t => {
       let expected = {"dest":"xslt", "site":"cross-site", "user":"", "mode": "no-cors"};
-      return fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=xslt-cross-site")
+      return fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=xslt-cross-site" + nonce)
           .then(response => response.text())
           .then(text => assert_header_equals(text, expected));
     }, "Cross-site xslt");