fix(media): request our own video and audio with CORS so Firefox does not block it

[eleboucher]

Description

Firefox blocks media Range responses whose URL it has not already sniffed as audio/video (mozilla bug 1880289), which homeservers serving application/octet-stream trip. The element then reports "no video with supported format and MIME type found" and the request shows as NS_BINDING_ABORTED. Requesting with CORS opts out of ORB.

Only applied to our own media, since external og:video URLs from link previews go through the same component and cannot be assumed to send Access-Control-Allow-Origin.

Verified on firefox

Fixes #

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings

AI disclosure:

• Partially AI assisted (clarify which code was AI assisted and briefly explain what it does).
• Fully AI generated (explain what all the generated code does in moderate detail).