Currently it is not specified how fonts are fetched. This PR attempts to fix that.

However, currently there is a behavior mismatch around referrers and fonts.
When fetching web-fonts, Gecko & Chromium send the URL of the stylesheet where the font is defined rather than the URL of the document as the referrer for the font (Safari loads web-fonts without CORS).

It's unclear what this was meant for, but it has the effect of not being fully compatible with preloading (<link rel="preload">). Because a preload doesn't have a way to specify a referrer, and the embedding HTML does not always know which stylesheet URL will eventually load the font, this may result in incompatibilities between the preloaded request and the actual request.

Also, browsers today have an out-of-spec "memory cache" or "resource cache" for fonts, where the referrer is not a cache key, so implementations are already depending on a behavior that fetching the same font with different referrers would be identical.

I suggest to not send the stylesheet URL as a referrer to avoid this problem, but I'm not sure of the implications.