Add 'unsafe-webtransport-hashes' keyword to connect-src

[jan-ivar]

Fixes #683. Assumes an unsafe-webtransport-hashes flag on request (seems simplest post w3c/webtransport#697).

@dveditz @annevk @martinthomson WDYT?

---

Preview | Diff

[annevk]

Looks reasonable overall. @antosart probably needs to review.

[antosart]

Do we also need to adapt the post-request check? The interaction between fetch an webtransport is not totally clear to me, but I guess it would also go through https://fetch.spec.whatwg.org/#ref-for-should-block-response%E2%91%A0 ?

[antosart]

Also, we probably need WPTs.

@mikewest after conversations at TPAC, do we already have an updated process for changes to the spec?

[mikewest]

No, it's been on my list since TPAC, but I haven't gotten a proposal out yet.

Certainly will require WPT coverage and signals from other vendors, though. I think we have the latter here, but not the former?

[jan-ivar]

I've added the post-request check and used "unsafe-webtransport-hashes is not empty" for now. Thanks for the reviews!

(Unless there are any takers) I'll work on WPT next!

[antosart]

I think this algorithm is not needed anymore