Make sec-purpose:prefetch cors-safelisted

Author: noamr

fetch.bs

@@ -981,6 +981,9 @@ fetch("https://victim.example/naïve-endpoint", {
       <p class=note>As web browsers have historically not emitted ranges such as
       `<code>bytes=-500</code>` this algorithm does not safelist them.
     </ol>
+   <dt>`<code>sec-purpose</code>`
+   <dd>
+     <p>If <var>value</var> is `<code>prefetch</code>`, return true. Otherwise return false.
 
    <dt>Otherwise
    <dd><p>Return false.