If a custom SecurityOrigin is set for a request, honor it in ResourceFetcher

XMLHttpRequest sets a special SecurityOrigin when it is constructed from an
isolated world. DocumentThreadableLoader uses this SecurityOrigin, but it is
not exposed to ResourceFetcher.

BUG=295829
TEST=http/tests/xmlhttprequest/xhr-to-blob-in-isolated-world.html

Review URL: https://codereview.chromium.org/107353003

git-svn-id: svn://svn.chromium.org/blink/trunk@163368 bbb929c8-8fbe-4397-9dbb-9b2b20218538