[document] plugin-types clarification

[jonathanKingston]

Plugin types are not defined in the specification at all: https://w3c.github.io/webappsec-csp/document/#directive-plugin-types

The HTML spec has a section on plugins(https://html.spec.whatwg.org/multipage/infrastructure.html#plugins) but doesn't clear up how plugin names are resolved. It somewhat implies that plugins are registered against content types where text/plain and application/octet-stream are exempt from the algo.

Could we at least clarify for now that plugins are registered to a content type and provide some examples? I'm not sure if this was left vague so that it could be extended to other types of embedded plugins however providing examples might help clarify this at least?

[mikewest]

https://www.w3.org/TR/CSP2/#directive-plugin-types has the behavior that we'll end up replicating, but it'll need some work in HTML to make sense. That's still TODO.

[mikewest]

https://w3c.github.io/webappsec-csp/#directive-plugin-types seems reasonable. Do you still think it needs changes, @jonathanKingston?

[jonathanKingston]

This is super clear now thank you @mikewest!