Flesh out cookie access specification

[mreichhoff]

There are a few open questions around the exact scope of the access granted by requestStorageAccessForOrigin, like:

• whether to require an explicit call to requestStorageAccess before granting access to a frame (to align with the proposed per-frame requestStorageAccess model and ensure embeddee opt-in)
• how widely to apply to subresources (options include applying to the top-level doc only, keeping a per-document set of granted domains like the potential per-frame requestStorageAccess storage bit, applying to nested docs, etc.) (though protection via CORS + use-credentials is needed).

As we get clarity, the spec and explainer should both be kept up-to-date.