Allow `crossorigin` attribute in headScript

See https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script#attr-crossorigin