Reland "[Connection-Allowlist] Enforce for speculation rules prerender"

This is a reland of commit 68d975aadb2878c61da2ed0174be429fe19cebd0

The test fails on Android builder because on Android feature
IsPrerender2FallbackPrefetchSpecRulesEnabled is disabled. There is no
prefetch ahead of the prerender. So the prerender request is made and
gets blocked by the connection allowlist. Its error code should be
UNSAFE_REDIRECT instead of ERR_ABORTED, which is the error code for
feature enabled case.

Original change's description:
> [Connection-Allowlist] Enforce for speculation rules prerender
>
> - The prerendering navigation request already correctly sets the
> initiator frame token. The Connection Allowlist(CA) check in navigation
> request enforces according to the initiator frame's CA.
> - Add browser test and WPT.
> - Add browser test for kPrerender2FallbackPrefetchSpecRules feature.
> When enabled, a fallback prefetch request is created for speculation
> rules prerender. The fallback prefetch is also checked by CA.
>
> About CA: https://github.com/WICG/connection-allowlists
>
> Bug: 447954811, 492462315
> Change-Id: I3f14f25d03c9d72eec5a652246769b6e4be36cae
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7886514
> Reviewed-by: Andrew Verge <averge@chromium.org>
> Commit-Queue: Xiaochen Zhou <xiaochenzh@chromium.org>
> Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org>
> Reviewed-by: Lingqi Chi <lingqi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#1642470}

Bug: 447954811, 492462315, 521162817
Cq-Include-Trybots: luci.chromium.try:android-14-arm64-rel,android-arm64-rel
Change-Id: I14fd7db06338ff4cee0a58e045e6404d9e0e83d0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7907724
Reviewed-by: Andrew Verge <averge@chromium.org>
Commit-Queue: Xiaochen Zhou <xiaochenzh@chromium.org>
Reviewed-by: Lingqi Chi <lingqi@chromium.org>
Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1643883}

Author: xiaochen-z

connection-allowlist/tentative/speculation_rules_prerender.https.sub.window.js

@@ -0,0 +1,56 @@
+// META: script=/common/get-host-info.sub.js
+// META: script=/common/utils.js
+// META: script=/common/dispatcher/dispatcher.js
+// META: script=/speculation-rules/prefetch/resources/utils.sub.js
+// META: script=resources/utils.js
+// META: timeout=long
+
+const port = get_host_info().HTTPS_PORT_ELIDED;
+const SUCCESS = true;
+const FAILURE = false;
+
+function prerender_test(origin, expectation) {
+  promise_test(
+      async t => {
+        const key = token();
+        const value = 'hello';
+        const params = new URLSearchParams();
+        params.set('key', key);
+        params.set('value', value);
+
+        const url = `${origin}${STORE_URL}?${params.toString()}`;
+        insertSpeculationRules({
+          prerender: [{source: 'list', urls: [url], eagerness: 'immediate'}]
+        });
+
+        if (expectation === SUCCESS) {
+          const result = await nextValueFromServer(key);
+          assert_equals(result, value);
+        } else {
+          const result = await Promise.race([
+            new Promise(r => t.step_timeout(r, 1000)), nextValueFromServer(key)
+          ]);
+          assert_true(typeof result === 'undefined');
+        }
+      },
+      `Prerender to ${origin} ${
+          expectation === SUCCESS ? 'succeeds' : 'fails'}.`);
+}
+
+// Note: SpeculationRules API currently does not support cross-site prerender.
+// Only same-site prerender is tested. See crbug.com/1176054.
+const test_cases = [
+  // Page loads originate from `http://hosts[][]`; prerendering this origin
+  // succeeds, while subdomains fail except `https://{{hosts[][www1]}}` which is
+  // allowed by the allowlist.
+  {origin: 'https://{{hosts[][]}}' + port, expectation: SUCCESS},
+  {origin: 'https://{{hosts[][www]}}' + port, expectation: FAILURE},
+  {origin: 'https://{{hosts[][www1]}}' + port, expectation: SUCCESS},
+  {origin: 'https://{{hosts[][www2]}}' + port, expectation: FAILURE},
+  {origin: 'https://{{hosts[][天気の良い日]}}' + port, expectation: FAILURE},
+  {origin: 'https://{{hosts[][élève]}}' + port, expectation: FAILURE},
+];
+
+for (let i = 0; i < test_cases.length; i++) {
+  prerender_test(test_cases[i].origin, test_cases[i].expectation);
+}

connection-allowlist/tentative/speculation_rules_prerender.https.sub.window.js.sub.headers

@@ -0,0 +1,2 @@
+
+Connection-Allowlist: (response-origin "*://{{hosts[][www1]}}:*" "*://*:*/*\\?*&ignore-allowlist=true*")