CORB shouldn't block application/dash+xml videos.

This addresses whatwg#886

fetch.bs

@@ -2891,7 +2891,7 @@ JSON inside an <code>img</code> element) and blocks them before they reach a web
 the risk of leaking sensitive data by keeping it further from cross-origin web pages.
 
 <p>A <dfn>CORB-protected MIME type</dfn> is an <a>HTML MIME type</a>, a <a>JSON MIME type</a>, or an
-<a>XML MIME type</a> excluding <code>image/svg+xml</code>.
+<a>XML MIME type</a> excluding <code>image/svg+xml</code> and <code>application/dash+xml</code>.
 
 <p class="note no-backref">Even without CORB, accessing the content of cross-origin resources with
 <a>CORB-protected MIME types</a> is either managed by the <a>CORS protocol</a> (e.g., in case of