Tests every known channel that might bypass shouldInterceptRequest / WebResourceRequested and the JS policy layer. Any Loaded result from a cross-origin URL is a confirmed bypass. Where a channel cannot directly confirm the request succeeded, a CORS fetch to the same domain is used as the oracle (if the oracle fetch also fails the channel is considered blocked).