chore: improve transform configs on sdk

[ScriptedAlchemy]

Description

If CORS headers are not set the application will fail to load remotes with crossorigin=anonymous
As fallback, attempt to inject script without cors tags

Related Issue

Types of changes

• Docs change / refactoring / dependency upgrade
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist

• I have added tests to cover my changes.
• All new and existing tests passed.
• I have updated the documentation.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8ea2a1d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[netlify]

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	8ea2a1d
🔍 Latest deploy log	https://app.netlify.com/sites/module-federation-docs/deploys/667f859df3927f0008d5452e
😎 Deploy Preview	https://deploy-preview-2643--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[ScriptedAlchemy]

@zhoushaw should we rather pass a flag from user options to enable crossorigin attribute or if user implements manifest then we enable cross origin?
In current state, this breaks default setup and in some cases like next.js requires additional work to try and debug.
The standard js format of a remote should be able to transmit as freely as possible. If the user wants to implement additional features like json remote. They will need cors configured to do so. But the default experience would still work out the box.