Hi Fred,
As dyn365 mentioned, adal.js is still required if you would like do any Dynamics 365 Web API request.
The reason is in your "Authorization": "Bearer" ... header, we can't simply add token in request header, this type of request will never be permitted by D365 server.
Instead, you should use authContext.acquireToken(organizationURL, yourFunction), which means we can only excute our own function that request to D365 Web API inside acquireToken callback scope.
You could take my simple demo as reference.(pure javascript, only run it with a live server extension from VS Code)
Get Token from Dynamics 365
Or run doc sample code directly:
https://docs.microsoft.com/en-us/powerapps/developer/common-data-service/walkthrough-registering-configuring-simplespa-application-adal-js
Settings in AAD application:
Whitelist your web page which requests Web API.(and enable Implicit grant)

Allow implicit flow:

Find you teanant in branding > publisher domain:

API permission:

Result:

Here are some other supplement I would like to share:
1. In first time running, you need to add your username and password in popup window,(sign in)
then user credential will save in your browser cache.
2. It seems that method or function for skipping login window only exists in back-end ways such as C# and Nodejs.
3. You can try to search whether the skipping login window method would be available in msal.js.
4. You could try whether Google sheet connector in Power Automate could meet your requirement.(without code)

Regards,
Clofly