We identified a potential need for a more sustainable no-cors mode in discussion
surrounding FedCM. The purpose is to create a browser-process priveleged mode
that will not fail the Access-Control-Allow-Origin CORS checks while otherwise
behaving like a normal CORS request.

Here are the deviations I have made from cors mode to make unsafe-no-cors are:

- do not perform the "CORS check" (ACAO/ACAC)
- allow the request to set a new omit origin flag that forces omission of the Origin header
- require a request to have a policy container specified (via the client is allowed)
- require the service worker mode to not be all

Because this is such an unsafe mode I added an explanation inline with the other
definitions of request modes and a warning about concerns and hand-waves about the
client's agent cluster.

Happy to get feedback on this draft!

"stable no-cors" vision

…afe-no-cors" mode