fix(live): detect CORS errors

[stipsan]

Detects CORS errors and throws a custom error:

CorsOriginError: The current origin is not allowed to connect to the Live Content API. 
Add it here: https://sanity.io/manage/project/hiomol4a/api?cors=add&origin=https%3A%2F%2Fexample.com

Go to https://example.com and run this snippet in your console to see the error for yourself:

const {createClient} = await import('https://esm.sh/@sanity/client@canary')

const client = createClient({
    projectId: 'hiomol4a',
    dataset: 'fashion-show',
    useCdn: true,
    apiVersion: 'X'
})

client.live.events().subscribe({next: (event) => console.log(event), error: err => console.error(err)})

Userland can use the CorsOriginError export to handle CORS differently than other errors:

import {CorsOriginError, createClient} from '@sanity/client'

const client = createClient({
  // ...
})

client.live.events().subscribe({
  next: (event) => {
    // ...
  },
  error: (err) => {
    if(err instanceof CorsOriginError) {
      toast.warn(err.message)
    } else {
      toast.error(err)
    }
  }
})

[socket-security]

New dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/msw@2.6.0	environment, filesystem, shell	+56	10.1 MB	kettanaito

View full report↗︎

[stipsan]

As explained further down, nock isn't able to intercept global.fetch, so we use msw for this.
We might be able to use msw instead of nock, but it feels out of scope for this PR.

[stipsan]

global.fetch is based on undici in node, which doesn't actually implement CORS, so we have to resort to some trickery to mimic the behaviour we want.