We have a section covering this in our documentation
here. You'll need to contact your ad server to request that they set up their CORS headers to allow IMA to request ads. In this particular case, as the error states, they have used a wildcard in their Access-Control-Allow-Origin header but also set credentials to true, which is not allowed. They'll have to change the Access-Control-Allow-Origin header to specifiy
imasdk.googleapis.com.