Add WPT for cross-site requests with credentials omitted

I initially thought this would trigger refreshes since we don't
check credentials mode in Session::ShouldDeferRequest. It turns out
there's an implicit dependency since the caller of
SessionService::ShouldDefer is
UrlRequestHttpJob::SetCookieHeaderAndStart, which is only called when
credentials mode allows credentials.

It seems worth testing that behavior, since it's an important
primitive for mitigating cross-site leaks.

Change-Id: Id7738597eaeb966167a4d8d71f69798648d684c2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6394915
Reviewed-by: thefrog <thefrog@chromium.org>
Commit-Queue: Daniel Rubery <drubery@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1438968}