[worklets] Restrict worklets to same-origin

See https://github.com/whatwg/fetch/pull/527#issuecomment-335560252 by @wanderview. This would allow us to make worklets proper clients.

cc @jakearchibald @jungkees @mikewest