What problem does this address?

In order to process media in the browser, support for SharedArrayBuffer is required. This issue covers all requirements, some of which are already in place in the codebase.

Acceptance Criteria:

• Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers are correctly set
• Iframe credentialless attribute is implemented with fallback for unsupported browsers
• embedded resources get 'crossorigin' 'anonymous' attribute
• Embed previews continue to work with appropriate fallbacks
• No breaking changes to existing editor functionality
• JavaScript code verifies crossOriginIsolated active before feature is loaded
• Documentation for plugin developers about cross-origin isolation implications