Add ephy-resource:// to CORS allowlist for access from PDF.js

The new version of PDF.js is having trouble loading our icons via
ephy-resource:// URIs. We're going to need to disable CORS to solve
this. We can replace it with some custom security checks to restrict
resource access as far as practical based on the URI scheme of the main
resource. Error page assets will have to be left open, though. It's
pretty hard to see how that could be abused, so I think it's OK.

Part-of: <https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/975>