if we see `credentialless` in the raw params, we should pass it along.

### Discussed in https://github.com/quarto-dev/quarto-cli/discussions/4913

<div type='discussions-op-text'>

<sup>Originally posted by **coatless** March 21, 2023</sup>
Right now, the video short code `{{ video }}` provides a standard iframe that automatically assumes the pages default headers.

https://github.com/quarto-dev/quarto-cli/blob/b0d668e4287f74f5208b510f37414a3341d7973b/src/resources/extensions/quarto/video/video.lua#L81

https://github.com/quarto-dev/quarto-cli/blob/b0d668e4287f74f5208b510f37414a3341d7973b/src/resources/extensions/quarto/video/video.lua#L108

https://github.com/quarto-dev/quarto-cli/blob/b0d668e4287f74f5208b510f37414a3341d7973b/src/resources/extensions/quarto/video/video.lua#L124


Would it be possible to have the short-code support or set by default a `credentialless` state? e.g.

```
<iframe credentialless src="https://example.com">
```

The `credentialles` state is important for [Cross-Origin-Embedder-Policy
 (COEP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy) environments. For [webR](https://docs.r-wasm.org/webr/latest/serving.html) startup and package installs, we need to set the COOP and COEP headers to significantly speed up the availability of in the browser R editor. We're running into issues with the iframe because when we turn on COEP, then any embedded lecture video from YouTube using the video shortcode is blocked with `"youtube refused to connect."`

![](https://user-images.githubusercontent.com/833642/226725454-76ab386b-d5df-46ac-9f7b-b7ce89a188af.png)

By having the `<iframe>` tag include `credentialless`, the iframe is loaded from a different, empty context. In particular, it is loaded without cookies. This allows for the removal of the COEP restriction for just the video will allow the entire page to still fall under the custom COOP and COEP headers.

For more background, please see: 

- Background on `iframe-credentialless` set: <https://developer.chrome.com/blog/iframe-credentialless/>
- Initial Proposal: <https://github.com/camillelamy/explainers/blob/main/anonymous_iframes.md>

Where the issue arose: https://github.com/coatless/quarto-webr/issues/8</div>
allenmanning
2023-03-21T20:09:27Z
cscheid
enhancement good-first-issue video
v1.4
open
Support for credentialless iframes to address COEP header needs
https://github.com/quarto-dev/quarto-cli/issues/4914