software/theia: require credentials to serve the manifest
favicon, manifest and service worker do not need to be public, for manifest it's required to explicitly make the link use credential.
favicon, manifest and service worker do not need to be public, for manifest it's required to explicitly make the link use credential.