Use fetch() instead of adding <script> tag for better Content-Security-Policy.

[rgroenewoudt]

The Bing layer loads JSON from dev.virtualearth.net. This is done by adding a <script> with a JSONP url which requires the domain added to script-src in the Content Security Policy.

This PR changes it to a fetch() which loads JSON and thus only requires adding the domain to safer connect-src in the Content-Security-Policy.

[johnd0e]

But we should also consider compatibility: https://caniuse.com/fetch
Is it time to say goodbye to IE and old Android?

[rgroenewoudt]

As this is a very simple usage of fetch(), a polyfill like https://github.com/github/fetch will work for backwards compatibility with old browsers.