Set up two websites on different registrable domains, and test what cross-domain cookie mechanics are enabled without using any modern web API, using similar workflows as third-party OAuth providers. This will be somewhat similar to what we are already doing in CentralAuth, the main question is whether doing redirects in a JS-opened popup, or maybe an iframe (as opposed to the original, top-level document) results in any browser restrictions, and whether those restrictions are lifted by user interaction.

The relevant documentation for popups / iframes: Chrome exemption heuristics, Firefox storage access heuristics / automatic storage access upon interaction, Webkit automatic storage access for popups
The relevant documentation for redirects: draft spec, Chrome bounce tracking mitigations, Firefox redirect tracking protection, Webkit bounce tracking protection and SameSite=Strict jail
Documentation on debugging: Safari ITP debug mode

This should be very similar to T359948: Test cross-domain cookie access with Storage Access API, except we'd access the cookies without requesting extra permission. We might want to reuse the same test code for checking both.

We should also check whether disabling exemption heuristics makes a difference (see docs for Chrome and Firefox), to make sure we aren't attributing something to Storage Access that's actually only possible due to temporary heuristics.