Consider simplifying reporting mechanism

[csharrison]

Currently, the API as proposed has some complexities around reporting. That is, third party reporting origins are declared by impression / conversion tags.

This could probably be simplified. Here is one alternative: just send reports directly to the advertiser or publisher (via a choice at the impression side). The target site can optionally fan-out to third party reporting endpoints via Reporting API / server-to-server / redirects / etc. This could be done for example via an <a> attribute: <a report-to={source,dest}>.

This has a few nice benefits:

1. It reduces the need for using Feature Policy to control reporting configurations (see issue Limiting the delivery of reports to untrusted third-parties using Feature Policy seems to go against the agreement on the scope of the Feature Policy specification #1).
2. It simplifies the API substantially, conceptually reducing the number of pertinent parties involved from 3 to 2.
3. It aligns better with the Reporting API, which cannot be configured via JS.

However, it has a major downside: it makes deployment harder, since it can't be done by the ad-tech on behalf of the advertiser / publisher. To integrate with their ad-tech, advertisers / publishers will need to make intentional server-side changes. We should weigh this trade-off against the benefits.

[apasel422]

I think this is obsolete. The reporting origin is specified by the attributionreportto attribute on the anchor tag.