fix: Add crossorigin attribute to script HTML tags

[pardoman]

The Problem
When an error occurs in a script that is not served by the
default server spawned by karma, the stack trace gets lost and
only the message "Script Error" is captured and reported back.
This makes it hard to pin-point where the error originated from.

The Solution
Add crossorigin attribute to generated script tags.

Solution is inspired by this article:
https://blog.getsentry.com/2016/05/17/what-is-script-error.html

[pardoman]

To help better explain what is being fixed here, see the following images.

Here's the issue I'm experiencing due to running tests from another server (which given my setup, I require this to be the case). Notice the "Script Error" output circled in red.

With the code in this PR, I was able to get the full stack trace of the error:

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed, please reply here (e.g. I signed it!) and we'll verify. Thanks.

---

• If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
• If you signed the CLA as a corporation, please let us know the company's name.

[pardoman]

I signed it!

[googlebot]

CLAs look good, thanks!

[dignifiedquire]

Thanks for this. Can you please change the commit message to follow our convention

[pardoman]

Sure thing, let me try that.

[pardoman]

@dignifiedquire updated

[pardoman]

Hmm, I see errors in tests. I'll take a look

[googlebot]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for the commit author(s). If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google.

[googlebot]

CLAs look good, thanks!

[pardoman]

I've updated the unit tests

I still haven't figured out how to update the e2e tests for cucumberjs:ci which are still failing (locally)

[pardoman]

Looks like all checks passed.

[dignifiedquire]

Thanks, just one last thing can you squash the two commits into one?

[pardoman]

Done, lets wait for the tests to run again. I've also rebased my branch.

[dignifiedquire]

Thanks

[pardoman]

My pleasure 👍

[Krinkle]

In retrospect, this "bug fix" released in a patch version (v1.1.1) is in fact an entirely new restriction that is imho considered a breaking change. Anyone using Karma with one of the test files served from another server needs to add crossOriginAttribute: false to the configuration. (And that option doesn't exist until v1.4.0).

This happens to coincide with regression fix #2220 for litixsoft/karma-mocha-reporter#67.

Upgrading to v1.1.1 fixed that but then broke everything else. The only way to get it fixed was to update directly to v1.4.0.

This could've been avoided if the option was disabled by default and kept opt-in until a later semver-minor or semver-major release.

Alternatively, it would've been avoided if it was supported to have Karma serve one of conf.files from a path in conf.proxies. That way it would've come from the same origin by default.