Refactor client-hints, add Permissions-Policy

[kamermans]

This PR reworks the Client-Hints / CORS-support headers so all code uses the same set of client-hints.

It also implements Permissions-Policy, the replacement for Feature-Policy as of Chrome 88
For more info see:

• Rename all the things w3c/webappsec-permissions-policy#379
• https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md#appendix-big-changes-since-this-was-called-feature-policy
• https://w3c.github.io/webappsec-permissions-policy/#permissions-policy-http-header-field

[jonarnes]

Permission policy does not seem to work... It doesn't delegate the hints to imageengine. When I removed the permission haeader, and left the feature policy in, it worked. PP seems to be bleeding edge. Good catch though! Was not aware of its inclusion in v88

[jonarnes]

Ah. " missing.
$permissions[] = strtolower( "ch-${hint}=(\"${protocol}://${host}\")" );

[kamermans]

Nice, thanks for testing that, I have a small update to push that cleans up some code and then I'll test it as well and we can create a new version.

[jonarnes]

lgtm