CSP syntax for require-trusted-types-for should be forgiving

[lukewarlow]

Currently the spec has an unforgiving syntax for require-trusted-types-for if you have an invalid sink group in your list it invalidates the whole directive. This isn't what's actually implemented in Chromium (or WebKit). The spec should instead have the value syntax as a space separated list and we simply discard values we don't recognise, this is how other CSP directives work and is better for forward compatibility.

[lukewarlow]

I'm not sure this is actually an issue in the Trusted Types spec per se. More a CSP issue in general. Because all of them are defined by strict grammars but script-src for example will parse as forgiving in all browsers.

cc @fred-wang