[Connection-Allowlist] Enforce for speculation rules prerender

- The prerendering navigation request already correctly sets the
initiator frame token. The Connection Allowlist(CA) check in navigation
request enforces according to the initiator frame's CA.
- Add browser test and WPT.
- Add browser test for kPrerender2FallbackPrefetchSpecRules feature.
When enabled, a fallback prefetch request is created for speculation
rules prerender. The fallback prefetch is also checked by CA.

About CA: https://github.com/WICG/connection-allowlists

Bug: 447954811, 492462315
Change-Id: I3f14f25d03c9d72eec5a652246769b6e4be36cae

Author: xiaochen-z

connection-allowlist/tentative/speculation_rules_prerender.https.sub.window.js

@@ -0,0 +1,56 @@
+// META: script=/common/get-host-info.sub.js
+// META: script=/common/utils.js
+// META: script=/common/dispatcher/dispatcher.js
+// META: script=/speculation-rules/prefetch/resources/utils.sub.js
+// META: script=resources/utils.js
+// META: timeout=long
+
+const port = get_host_info().HTTPS_PORT_ELIDED;
+const SUCCESS = true;
+const FAILURE = false;
+
+function prerender_test(origin, expectation) {
+  promise_test(
+      async t => {
+        const key = token();
+        const value = 'hello';
+        const params = new URLSearchParams();
+        params.set('key', key);
+        params.set('value', value);
+
+        const url = `${origin}${STORE_URL}?${params.toString()}`;
+        insertSpeculationRules({
+          prerender: [{source: 'list', urls: [url], eagerness: 'immediate'}]
+        });
+
+        if (expectation === SUCCESS) {
+          const result = await nextValueFromServer(key);
+          assert_equals(result, value);
+        } else {
+          const result = await Promise.race([
+            new Promise(r => t.step_timeout(r, 1000)), nextValueFromServer(key)
+          ]);
+          assert_true(typeof result === 'undefined');
+        }
+      },
+      `Prerender to ${origin} ${
+          expectation === SUCCESS ? 'succeeds' : 'fails'}.`);
+}
+
+// Note: SpeculationRules API currently does not support cross-site prerender.
+// Only same-site prerender is tested. See crbug.com/1176054.
+const test_cases = [
+  // Page loads originate from `http://hosts[][]`; prerendering this origin
+  // succeeds, while subdomains fail except `https://{{hosts[][www1]}}` which is
+  // allowed by the allowlist.
+  {origin: 'https://{{hosts[][]}}' + port, expectation: SUCCESS},
+  {origin: 'https://{{hosts[][www]}}' + port, expectation: FAILURE},
+  {origin: 'https://{{hosts[][www1]}}' + port, expectation: SUCCESS},
+  {origin: 'https://{{hosts[][www2]}}' + port, expectation: FAILURE},
+  {origin: 'https://{{hosts[][天気の良い日]}}' + port, expectation: FAILURE},
+  {origin: 'https://{{hosts[][élève]}}' + port, expectation: FAILURE},
+];
+
+for (let i = 0; i < test_cases.length; i++) {
+  prerender_test(test_cases[i].origin, test_cases[i].expectation);
+}

connection-allowlist/tentative/speculation_rules_prerender.https.sub.window.js.sub.headers

@@ -0,0 +1,2 @@
+
+Connection-Allowlist: (response-origin "*://{{hosts[][www1]}}:*" "*://*:*/*\\?*&ignore-allowlist=true*")