In #687 there was a strong interest, notably by @arturjanc, to make Cross-Origin-Resource-Policy accept literal origins.

Things to decide:

• Multiple values or not.
• Byte-for-byte matching after any splitting if we do multiple values (yes please).

This also means we can no longer fail open. E.g., the tests in web-platform-tests/wpt#11427 would have to be flipped so they expect rejection instead since we do not know that the unrecognized values are not origins.

cc @johnwilander @youennf