Add the Cross-Origin-Opener-Policy header

Fixes whatwg#3740. Closes whatwg#4580.

Need to check again if it closes them:

* whatwg#4921
* whatwg#5168
* whatwg#5172
* whatwg#5198 (probably not?)

Co-authored-by: Anne van Kesteren <annevk@annevk.nl>