Context: #70 #71

Given that most reporting API providers are crossed origins, we propose to allow this feature by default for 3rd-party iframes.

User should be able to opt out the feature with the corresponding Permissions Policy.