[BackgroundFetch] Pass credentials mode to download service & apply CORS

The credentials mode will now be passed to the DownloadService. By
default, requests will use 'same-origin' as opposed to 'include'.

CORS checks related to credentials are also applied now, to avoid
exposing response bodies/progress when applicable.

Bug: 1239709, 711354
Change-Id: I03d9e375ce0565d128d7b5596909da713f5a68df
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3100646


Auto-Submit: Rayan Kanso <rayankans@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Reviewed-by: Peter Beverloo <peter@chromium.org>
Commit-Queue: Rayan Kanso <rayankans@chromium.org>
Cr-Commit-Position: refs/heads/main@{#915927}