New guideline on fetch metadata request headers?

[torgo]

Something like:

Enforce Fetch Metadata Request Headers
Fetch Metadata is a set of security headers designed by the W3C Web Application Security Working Group to help protect web applications from cross-site request forgery (CSRF), cross-site leaks (XS-Leaks), and other cross-origin attacks. These headers allow servers to determine whether an incoming request originates from a trusted source or an untrusted cross-site context.

Find out more here: https://developer.mozilla.org/en-US/docs/Glossary/Fetch_metadata_request_header and here https://web.dev/articles/fetch-metadata

[torgo]

side-note : this spec https://www.w3.org/TR/fetch-metadata/ is still listed as a draft even though it's been implemented in all browsers. We should probably encourage it to be published as a proper rec.