No clear place where we allocate a srcdoc document

[annevk]

And as a result, the way a srcdoc document gets state is all over the map. We define its origin, HTTPS state, and referrer policy in three different ways. Its base URL is non-static (see #421; I think this is a bug since everything else appears static).

It does seem to consistently inherit state from its parent document (which is different from about:blank, which should inherit from the source document/browsing context, but doesn't in all browsers).

This relates to #1445.