Add trusted-types-eval source expression for script-src

[lukewarlow]

This new keyword allows enabling eval only when trusted types are enforced. Such that in browsers that don't support trusted types no eval is allowed, unlike with unsafe-eval. This concept was brought up at previous WebAppSec WG meetings.

Implementor Interest:

• Mozilla (see New trusted-types-eval keyword for CSP script-src mozilla/standards-positions#1032)

• WebKit (see New trusted-types-eval keyword for CSP script-src WebKit/standards-positions#355)

• Chromium - Not sure how best to get an official Google position but Lukas is supportive per New trusted-types-eval keyword for CSP script-src WebKit/standards-positions#355 (comment)

Implementation Bugs:

• WebKit (see https://bugs.webkit.org/show_bug.cgi?id=285603)
• Gecko (see https://bugzilla.mozilla.org/show_bug.cgi?id=1940493)
• Chromium (see https://issues.chromium.org/issues/388437274)

---

Preview | Diff

[lukewarlow]

cc @otherdaniel @koto to gather Google feedback.

Mozilla Position Request: mozilla/standards-positions#1032

WebKit Position Request: WebKit/standards-positions#355

[lukewarlow]

@mikewest if you've got time it'd be brilliant to get an editorial review of this too. Still waiting on some browser positions so won't merge yet.

[lukewarlow]

Failing pipeline here seems to be related to a change already merged, rather than this PR. For now I'll leave it "broken" but happy to address if that's desired.

Made a WebKit PR at WebKit/WebKit#38741 so would be good to get this PR merged. Given the above standards positions is there a process for requesting review and approval like whatwg has?

[mikewest]

We're working on defining the process for updating this spec, and I do hope we'll land on something similar to WHATWG's.

That said, we discussed this specific item at TPAC (https://github.com/w3c/webappsec/blob/main/meetings/2024/2024-09-26-TPAC-minutes.md#trusted-types-eval), there are positive signals from WebKit (WebKit/standards-positions#355), and Mozilla (mozilla/standards-positions#1032). I think whatever process we end up with would accept that as Good Enough™.

With that in mind, I'm comfortable landing this prior to solidifying a new process. @dveditz, WDYT?

[lukewarlow]

Based on todays meeting I'm going to go ahead and merge this. Thanks for the reviews.