Set 'Cross-Origin-Resource-Policy: cross-origin' header on jQuery CDN responses

[Krinkle]

@mikewest wrote at jquery/codeorigin.jquery.com#57:

https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zMEu9ySMCiTGMS9y0GU92k/edit#bookmark=id.kaco6v4zwnx2 is part of an explainer for the general approach browsers are taking.

[…] Digging through HTTP Archive, I see ~158k sites depending on a script resource of some sort from code.jquery.com.

@mikewest wrote at MaxCDN/bootstrapcdn#1495:

Yes, Cross-Origin-Resource-Policy: cross-origin is what you'd apply to resources that ought to be embeddable across the web.