fix: use same-origin-allow-popups for COOP header to support II popups

Cross-Origin-Opener-Policy: same-origin blocks communication between
the dapp window and the Internet Identity popup (different canister
origins). Change to same-origin-allow-popups which still protects
against being opened by other origins but allows the dapp to open
II authentication popups that can communicate back.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Web3NL

packages-rs/canister-dapp-test/src/lib.rs

@@ -384,7 +384,7 @@ pub fn run_acceptance_suite(wasm_bytes: &[u8], wasm_label: &str) {
     assert_header_contains(
         &fallback_resp,
         "cross-origin-opener-policy",
-        "same-origin",
+        "same-origin-allow-popups",
     );
     assert_header_contains(
         &fallback_resp,

packages-rs/my-canister-frontend/src/asset_router.rs

@@ -279,7 +279,10 @@ fn create_default_headers(_content_type: &str) -> Vec<(String, String)> {
             "accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=()"
                 .into(),
         ),
-        ("Cross-Origin-Opener-Policy".into(), "same-origin".into()),
+        (
+            "Cross-Origin-Opener-Policy".into(),
+            "same-origin-allow-popups".into(),
+        ),
         (
             "Cross-Origin-Resource-Policy".into(),
             "same-origin".into(),
@@ -560,7 +563,10 @@ mod tests {
         fn includes_cross_origin_opener_policy() {
             let headers = create_default_headers("text/html");
             assert!(
-                headers.contains(&("Cross-Origin-Opener-Policy".into(), "same-origin".into()))
+                headers.contains(&(
+                    "Cross-Origin-Opener-Policy".into(),
+                    "same-origin-allow-popups".into(),
+                ))
             );
         }