Expose fragments cross-origin for subresources

[annevk]

Note: this is not about navigation. This is only about <img>, fetch(), and similar such APIs.

The question is whether it's acceptable to expose URL fragments across origins for foreign fetch (raised in #854).

I'm inclined to say yes, since again, this is not navigation, and fragments for subresources have no meaning typically (and when they do they are leaked in some header form to servers usually).