Make fetch() use "same-origin" credentials by default

Most features in the platform have this default and not having this default causes multiple connections in contemporary implementations. It also causes confusion as switching from XMLHttpRequest to fetch() is not as seamless as it could be.

Making this change will also make it easier for <script type=module> to have this default as per discussion in whatwg/html#2557.

fetch.bs

@@ -4774,7 +4774,7 @@ constructor must run these steps:
 
    <li><p>Set <var>fallbackMode</var> to "<code>cors</code>".
 
-   <li><p>Set <var>fallbackCredentials</var> to "<code>omit</code>".
+   <li><p>Set <var>fallbackCredentials</var> to "<code>same-origin</code>".
   </ol>
 
  <li>