Sort out when blob: URLs can be fetched / navigated

[annevk]

This is basically to ensure we track whatwg/fetch#666 in this repository as well.

As part of web-platform-tests/wpt#17606 I've found that that when A embeds B, B can navigate itself to a blob URL of B's creation. But if B hands that to A and A navigates B, it does not work when B is cross-origin. So it does seem to depend on the "source browsing context" (which really is a source document) in some manner.

[annevk]

This is a bit of problem when defining new features such as COOP, as it's unclear how inheritance of certain policies would work. See also #142.