fix(runner): Fix loading of external scripts without cors headers

[dotch]

As described in #2249, external scripts without the necessary Access-Control-Allow-Origin header are rejected with:

Script from origin '...' has been blocked from loading by 
Cross-Origin Resource Sharing policy: 
No 'Access-Control-Allow-Origin' header is present on the 
requested resource. Origin '...' is therefore not allowed access.

This PR reverts the change that introduced this behavior.

If we want to keep the benefits that were introduced with #2219 we could create a configuration option for this.
In that case we'd have to decide what we want as a default behavior.

[dignifiedquire]

Let's keep the current behaviour as the default one, and allow to disable it via configuration.

[dotch]

I added a crossOriginAttribute configuration option. (open to better naming)

[dignifiedquire]

Thanks I'm afraid I don't have any better name ideas either.