[css-values-4] Use "include" when fetching cross-origin CSS resources

[noamr]

This matches existing implementation, and was a bug in the existing spec.

Closes #12073

[css-spec-shortname-1] Brief description which should also include the #issuenum-or-URL and/or link to relevant CSSWG minutes.

Copy the above line into the Title and replace with the relevant details. Fill in any additional details here. See https://github.com/w3c/csswg-drafts/blob/master/CONTRIBUTING.md for more info.

[weinig]

If you make this change, you'll also need to update CSS Values 5 to specify what do for crossorigin(anonymous) as it currently just uses the default (https://drafts.csswg.org/css-values-5/#typedef-request-url-modifier-crossorigin-modifier).

[noamr]

If you make this change, you'll also need to update CSS Values 5 to specify what do for crossorigin(anonymous) as it currently just uses the default (https://drafts.csswg.org/css-values-5/#typedef-request-url-modifier-crossorigin-modifier).

You're right! Not just that, but existing callers that use |corsMode| = "cors" would receive the wrong credentials mode.
Amended so that:

• The URL modifiers in css-values-5 explicitly set same-origin when anonymous
• The default for cors-mode is anonymous, and only the no-cors default changes to use-credentials.