Set Cross-Origin-Resource-Policy on /_next/static assets

[lnuvy]

Set Cross-Origin-Resource-Policy: same-origin on responses served from /_next/static/* in router-server.ts.

Why

Turbopack writes worker-entrypoint.js to /_next/static/ (added in #d23af53) and loads it with new Worker(...). When the document sets Cross-Origin-Embedder-Policy: require-corp, the browser blocks that fetch because Next.js does not send a CORP header for it. This breaks every app that enables COEP and uses a Worker on 16.2, a regression from 16.1.

same-origin is safe here because these are first-party build artifacts. The fix only sets the header when the user hasn't already set one via headers().

Fixes #92676

Test plan

New e2e test at test/e2e/app-dir/worker-coep:

• loads a worker on a page with COEP require-corp and asserts the worker's message arrives
• asserts /_next/static/<buildId>/_buildManifest.js responds with cross-origin-resource-policy: same-origin

Verified locally in dev/Turbopack, start/Turbopack, and dev/webpack. Without the fix, the CORP assertion fails with Expected: "same-origin" / Received: null.

[nextjs-bot]

Allow CI Workflow Run

• approve CI run for commit: c143c5d

Note: this should only be enabled once the PR is ready to go and can only be enabled by a maintainer