Feat(image objects): clarify how to fetch (closes #443)

[marcoscaceres]

@jakearchibald WIP, let me know if this is ok?

[kenchris]

an not and

[jakearchibald]

This looks great to me. The only bit I'm unsure of is if client should be set or not. Null seems fine since that allows the image to be fetched without a client present, but would like a second opinion from @annevk.

[annevk]

If you don't provide a client you should probably provide a referrer and maybe some other data. I guess it might makes sense to not have a client here, since it's a bit separate from the page. Not entirely sure, haven't thought about manifests too much. Still not really sold on them.

[marcoscaceres]

If you don't provide a client you should probably provide a referrer

Good point about referrer. Added that to be the manifest's URL, obviously. Will leave the others as is for now and see how we go implementation wise.

[annevk]

Referrer policy also needs to come from somewhere. I guess if you don't have a client you'll need some integration with the referrer policy specification then...

[marcoscaceres]

@annevk, we do always have a reference back to the Document and the Link element that kicked off the request. Can we use that as a means to get a suitable client (e.g., the window object)?

[marcoscaceres]

opened #465

[annevk]

Yeah, maybe that's better. Although it's a little weird since you can be associated with multiple documents, right? And that document might disappear and then another one might appear? Would that mean you get a new policy?

How does CSP work today for manifest resources?