Use fetch() instead of adding <script> tag for better Content-Security-Policy.

[rgroenewoudt]

The Bing layer loads JSON from dev.virtualearth.net. This is done by adding a

This PR changes it to a fetch() which loads JSON and thus only requires adding the domain to safer connect-src in the Content-Security-Policy.

[johnd0e]

But we should also consider compatibility: https://caniuse.com/fetch Is it time to say goodbye to IE and old Android?

[rgroenewoudt]

As this is a very simple usage of fetch(), a polyfill like https://github.com/github/fetch will work for backwards compatibility with old browsers.