disambiguate resource in csp sample (#257)

* disambiguate resource in csp sample

Clarified comment on CSP extraction from resource metadata.

* Update specification/draft/apps.mdx

Co-authored-by: Copilot <[email protected]>

---------

Co-authored-by: Copilot <[email protected]>

Author: idosal

specification/draft/apps.mdx

@@ -1648,7 +1648,7 @@ Hosts MUST enforce Content Security Policies based on resource metadata.
 **CSP Construction from Metadata:**
 
 ```typescript
-const csp = resource._meta?.ui?.csp;
+const csp = resource._meta?.ui?.csp; // `resource` is extracted from the `contents` of the `resources/read` result
 const permissions = resource._meta?.ui?.permissions;
 
 const cspValue = `