emrun: Set COOP,COEP and CORP headers

[msabwat]

This enables emrun to serve pages by taking into account
the upcoming restrictions on Content Policy for Firefox 72.

In Firefox 71, we currently need to set these flags to test the
upcoming feature:
browser.tabs.remote.useCORP
browser.tabs.remote.useCrossOriginOpenerPolicy
browser.tabs.remote.useCrossOriginEmbedderPolicy
dom.postMessage.sharedArrayBuffer.withCOOP_COEP

This PR is a fwp on @VirtualTim ticket:
Fixes #10014

[juj]

Those Firefox flags can be set here:

https://github.com/emscripten-core/emscripten/blob/incoming/emrun.py#L331

(add them to last position in the file, they need to be in chronological order of adoption)

[msabwat]

test_offset_converter is failing and I have no idea why 😓
it is a test that is usually skipped on previous PRs:

test_offset_converter (test_browser.browser) ... skipped 'is_wasm_backend : offset converter is not supported on fastcomp'

can this be skipped here too?

[kripken]

I've seen that error before, but not sure why it happens - seems random. I restarted those two jobs. If they don't pass now, please merge in latest incoming. If that doesn't fix things, then we'll need to do more serious investigation (separately from this PR).

[juj]

Hmm, in Firefox Nightly I see there is a field dom.postMessage.sharedArrayBuffer.bypassCOOP_COEP.insecure.enabled: boolean. I see that toggling that makes FF Nightly work as before? Perhaps setting that in the Firefox prefs list would be good here?

[annevk]

@juj that's mainly meant for testing, will never work on Release, and might eventually be redone in some manner.

[juj]

Great, thanks!

[VirtualTim]

Thanks @msabwat.

[tuket]

Hello!
I'm using emrun to create a webserver.
Then, I use my Android phone (that is connected to the same local network) to access the webpage (using the local IP as URL: 192.168.0.104:9090).

The Cross-Origin-Opener-Policy header has been ignored, because the URL's origin was untrustworthy. It was defined either in the final response or a redirect. Please deliver the response using the HTTPS protocol. You can also use the 'localhost' origin instead. See https://www.w3.org/TR/powerful-features/#potentially-trustworthy-origin and https://html.spec.whatwg.org/#the-cross-origin-opener-policy-header.
GoldenViewer.js:1017 Uncaught ReferenceError: SharedArrayBuffer is not defined
    at GoldenViewer.js:1017:38

I'm not sure what should I do.

[msabwat]

Hi,
The error here is that you didn't use https IIUC.
Localhost is unique, so you don't need a certificate, but for any other address/domain, you will need an ssl certificate.
also, it depends on the browser you are using. https://caniuse.com/sharedarraybuffer

[tuket]

Thanks, mate.
I ended up using nginx as a server, so I should be able to use local certificates with mkcert. So far I couldn't get it to work, but getting closer xD