Allow `crossorigin` attribute in headScript

See https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script#attr-crossorigin
Can we also change this to one-per-line for easier diffing in future?