Clarify the $csp rules usage

[ameshkov]

1. $csp rules use the regular matching algorithm. e.g. $csp=script-src 'none',domain=example.org will match the https://example.org: Domain restrictions semantics AdguardBrowserExtension#1474.
2. $csp rules are applied to both DOCUMENT resources: https://stackoverflow.com/questions/54203764/content-security-policy-csp-header-onto-each-file-or-only-the-actual-html-pag:

   "The resources which can be requested (and subsequently embedded or executed) on behalf of a specific Document or Worker"

We should figure out what to do with the Workers part. It seems that it does not really work in Chrome, only in FF.

[sxgunchenko]

1. works as intended
2. already discussed