[Accessibility] Declarative permissions in parent scope for filesystem access via fileURLs

[ghost]

Background:

The web was firstly created in order to gain access to files within a local network. However, today, users of a web application can not even access their own files on their own computer...

To solve this problem, many API have been developed for granting filesystem access permissions to applications, but what those API designs do forget, is that the web is not only a browser and a web server, but also the local computer which allows the browser to operate and the content of which can be accessed via fileURLs.

Proposal:

By default, filesystem access should not be made via specific APIs, such a Filesystem Access API, but rather should be incorporated into the Fetch API, via fileURLs, and according to secure permissions contexts (#1209).
FileURLs access from non-fileURLs should thus be allowed in the context of a parent scope permission, that could be granted by the user according to different permissions mechanisms to be defined in a separate issue concerning user-granted permissions.

Example:

<script allow-net="file://path/to/a/document.json">
/* script has access to a particular document via fetchAPI with fileURL*/
fetch('file://path/to/a/document.json')
  .then(response => response.json())
  .then(data => console.log(data));
</script>

<script allow-net="file://path/to/a/documentfolder">
/* script has access to a particular document folder via fetchAPI with fileURLs*/
fetch('file://path/to/a/documentfolder/data.json')
  .then(response => response.json())
  .then(data => console.log(data));
</script>

[domenic]

Closing per #1209 (comment)