[import] Use master document's origin to resolve CORS

This follows the spec change on https://www.w3.org/Bugs/Public/show_bug.cgi?id=24905
where the fetch origin is given by the master document, not the referring document.
This matches what CSP in imports is doing: Using master's CSP directive to regulate
all the imports.

In implemntation, it just set ResourceLoaderOptions::m_securityOrigin in
FetchRequest::setCrossOriginAccessControl() because HTMLImportsController
happened to pass the master' origin already.
(That was wrong but wasn't covered by the test.)

This change doesn't affect other FetchRequest client because in other callsite,
m_securityOrigin is same as one that is used when it is absent.

TEST=cors-same-origin.html
BUG=348671
R=abarth@chromium.org, dglazkov@chromium.org

Review URL: https://codereview.chromium.org/186803005

git-svn-id: svn://svn.chromium.org/blink/trunk@168497 bbb929c8-8fbe-4397-9dbb-9b2b20218538