Related to #4921 by @shhnjk, @mystor pointed out that in addition to computing the origin way before we are ready to create a document, we also need to have the secure context state way before we are ready to have a settings object. This is particularly relevant for Cross-Origin-Embedder-Policy, which can work in a framed context, provided that frame is a secure context.

cc @mikewest