Improved CORS policy support to fix debug mode visualizations

[rawnsley]

This PR allows Hubs to use a Cross-Origin Resource Policy and run in cross-origin isolated mode.

A couple of significant features rely on running in isolated mode:

1. SharedArrayBuffer, which is currently only used for debug visualization, but may be useful in the future.
2. High-precision timers such as performance.now()

It's not clear what the impact of [2] is, but it has been implicated in at least one A-Frame issue. The fact that it is used in several places in Hubs and that the low-precision version varies by browser is probably enough to suggest it would be better to take it off the board as a source of bad behaviour.

The PR changes should be neutral when no CORS resource policy is applied, but will be activated by specifying a CORS resource policy in the HTTP headers:

The referenced resources, most of which are stored in S3, already have CORS policies defined and should just continue to work.

It is also worth considering this companion PR, which enables isolation for the local development environement.

For reference you can check page context isolation status from the console using this global boolean flag. You can also see the maximum precision available by running something like this from your browser console:

Math.round((() => { const start = performance.now(); let diff; while ((diff = performance.now() - start) === 0); return diff * 1000;})()) + "µs";

At time of writing I get 100µs in Chrome and 1000µs in Firefox outside of an isolate context, but 5µs and 20µs inside.

Note that none of these things are supported by Safari on desktop or iOS yet, but they don't support SharedArrayBuffer currently anyway.

┆Issue is synchronized with this Jira Task