The Cross-Origin-Embedder-Policy header now supports the additional value credentialless (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy#credentialless), but the Spring Security enum CrossOriginEmbedderPolicy does not have this value, so it is not possible to configure via DSL.

The CrossOriginEmbedderPolicy should have the additional value for credentialless so it is configurable via DSL.

Currently this enum value does not exist, so we have to add custom code to add this Cross-Origin-Embedder-Policy: credentialless header, rather than using the DSL.