Request's tainted origin flag fallout

[annevk]

@yutakahirano noticed one more place that relied request's origin becoming an opaque origin: step 5 of main fetch.

I incorrectly assumed this wouldn't be a problem due to the CORS flag, but the CORS flag is not set if the initial request was same-origin.

I think making the first conditional of step 5 instead read

request's current url's origin is same origin with request's origin, CORS flag is unset, and either request's tainted origin flag is unset or request's mode is not "cors"

would fix this.

This is somewhat related to #737.

[annevk]

Note for future me: the fix in OP wasn't quite correct as a "no-cors" response shouldn't be considered same origin if there is a cross-origin redirect involved.