Update to PDF.js 2.10.377

This requires exempting ephy-resource:// from CORS, so that pdf.js can
load its icons. Accordingly, some new smarts are added to the
ephy-resource:// handler to manually verify that source of requests is
acceptable, as far as practical. There's no longer any way to prevent
websites from accessing the error page stuff anymore, but the rest can
still be restricted.

Part-of: <https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/975>