Add support for trusted-types and require-trusted-types

[kingthorin]

It would be nice to have handling for: the trusted-types trusted-types and require-trusted-types-for require-trusted-types-for directives.

This advice was provided pre-fork:

---

The process will be basically

• define new Value Value kinds for new directive values which are more complex than just a boolean. At a glance, you probably want a special Value kind for tt-policy-name, but the others look like they can be handled as booleans on the directive.

• define new Directives Directive kind for both new directives (trusted-types trusted-types) and (require-trusted-types-for require-trusted-types-for)

• add helpers to allow reading and writing their attributes, and ensure that updating keeps their internal values field up to date (by using the addValue and removeValueIgnoringCase helpers, mainly)

• define new Value Value kinds for new directive values which are more complex than just a boolean. At a glance, you probably want a special Value kind for tt-policy-name, but the others look like they can be handled as booleans on the directive.

• define new Directives Directive kind for both new directives ("trusted-types" and ("require-trusted-types-for")

• add helpers to allow reading and writing their attributes, and ensure that updating keeps their internal values field up to date (by using the addValue and removeValueIgnoringCase helpers, mainly)

• update the parser to handle them

• add tests

• optionally add helpers for queries like "Should Trusted Type policy creation be blocked by Content Security Policy?" Should Trusted Type policy creation be blocked by Content Security Policy?, though these aren't so important.update the parser to handle them

The main challenges in my experience is figuring out what the spec is trying to say and whether that's actually what browsers do. For example, it says the syntax is defined by an ABNF, which means keywords are case-insensitive ("ABNF strings are case insensitive"). So per spec, 'ALLow-DUPlicATES' is a legal way to write 'allow-duplicates'. Is that actually intentional? Is that what browsers do? Gotta check. Similarly, are policy names case-sensitive or not? That affects the representation and especially the manipulation of those Values.

[kingthorin]

FYI @zaproxy is now using this library :grinning: https://github.com/zaproxy/zap-extensions/pull/5231