Body sizes should be CORS rather than TAO protected

The encoded/decoded body size relate to the resource, not to the timing.

Tests: web-platform-tests/wpt#37884 & web-platform-tests/wpt#37257.

This is part of w3c/resource-timing#220 (comment).

Co-authored-by: Anne van Kesteren <annevk@annevk.nl>

fetch.bs

@@ -2396,7 +2396,8 @@ this is also tracked internally using the request's <a for=request>timing allow
 <p>A <dfn export id=concept-network-error>network error</dfn> is a <a for=/>response</a> whose
 <a for=response>type</a> is "<code>error</code>", <a for=response>status</a> is 0,
 <a for=response>status message</a> is the empty byte sequence,
-<a for=response>header list</a> is « », and <a for=response>body</a> is null.
+<a for=response>header list</a> is « », <a for=response>body</a> is null, and
+<a for=response>body info</a> is a new <a for=/>response body info</a>.
 
 <p>An <dfn export id=concept-aborted-network-error>aborted network error</dfn> is a
 <a>network error</a> whose <a for=response>aborted flag</a> is set.
@@ -2467,17 +2468,19 @@ of defining the concrete types of <a for=/>filtered responses</a>.)
 <a for=response>URL list</a> is « »,
 <a for=response>status</a> is 0,
 <a for=response>status message</a> is the empty byte sequence,
-<a for=response>header list</a> is « », and
-<a for=response>body</a> is null.
+<a for=response>header list</a> is « »,
+<a for=response>body</a> is null, and
+<a for=response>body info</a> is a new <a for=/>response body info</a>.
 
 <p>An
 <dfn export id=concept-filtered-response-opaque-redirect>opaque-redirect filtered response</dfn>
 is a <a>filtered response</a> whose
 <a for=response>type</a> is "<code>opaqueredirect</code>",
 <a for=response>status</a> is 0,
 <a for=response>status message</a> is the empty byte sequence,
-<a for=response>header list</a> is « », and
-<a for=response>body</a> is null.
+<a for=response>header list</a> is « »,
+<a for=response>body</a> is null, and
+<a for=response>body info</a> is a new <a for=/>response body info</a>.
 
 <div class=note>
  <p>Exposing the <a for=response>URL list</a> for
@@ -4696,8 +4699,7 @@ steps:
      <li>
       <p>If <var>response</var>'s <a for=response>timing allow passed flag</a> is not set,
       then set <var>timingInfo</var> to the result of <a>creating an opaque timing info</a> for
-      <var>timingInfo</var>, set <var>bodyInfo</var> to a new <a for=/>response body info</a>, and
-      set <var>cacheState</var> to the empty string.
+      <var>timingInfo</var> and set <var>cacheState</var> to the empty string.
 
       <p class=note>This covers the case of <var>response</var> being a <a>network error</a>.