Fix duplicate Trusted Types policy creation when spawning workers

[Young-Lord]

allocateUnusedWorker() and _emscripten_create_wasm_worker() called trustedTypes.createPolicy() on every Worker creation. The Trusted Types spec forbids reusing a policy name unless CSP allows duplicates, so programs with 2+ pthreads (or wasm workers) failed under Trusted Types enforcement.

Cache each policy once and pass the script URL through createScriptURL.

---

Reproducer (spawn 3 pthreads):

// main.c
#include <pthread.h>
#include <stdio.h>

static void *thread_fn(void *arg) {
  printf("thread %d running\n", *(int *)arg);
  return NULL;
}

int main(void) {
  enum { N = 3 };
  pthread_t t[N];
  int ids[N];
  for (int i = 0; i < N; i++) {
    ids[i] = i;
    if (pthread_create(&t[i], NULL, thread_fn, &ids[i])) return 1;
  }
  for (int i = 0; i < N; i++) pthread_join(t[i], NULL);
  printf("all %d threads completed\n", N);
  return 0;
}

Build:

emcc main.c -o main.js -pthread -sTRUSTED_TYPES=1 -sENVIRONMENT=web,worker -sPTHREAD_POOL_SIZE=3

Serve with Trusted Types CSP:

# serve.py
import http.server, os

DIR = os.path.dirname(os.path.abspath(__file__))

class Handler(http.server.SimpleHTTPRequestHandler):
    def __init__(self, *a, **kw):
        super().__init__(*a, directory=DIR, **kw)

    def end_headers(self):
        self.send_header("Cross-Origin-Opener-Policy", "same-origin")
        self.send_header("Cross-Origin-Embedder-Policy", "require-corp")
        self.send_header(
            "Content-Security-Policy",
            "require-trusted-types-for 'script'; "
            "trusted-types emscripten#workerPolicy2",
        )
        super().end_headers()

http.server.HTTPServer(("", 8080), Handler).serve_forever()

python3 serve.py
# open http://localhost:8080 in Chromium, DevTools console (F12)

Expected: thread 0/1/2 running, then all 3 threads completed.
Actual (without this patch): During startup, initMainThread() synchronously pre-creates the worker pool (PTHREAD_POOL_SIZE=3); the second allocateUnusedWorker() throws on duplicate createPolicy, aborting module initialization. Console outputs:

Creating a TrustedTypePolicy named 'emscripten#workerPolicy2' violates the following Content Security Policy directive because a TrustedTypePolicy with that name already exists and the directive does not contain'allow-duplicates': "trusted-types emscripten#workerPolicy2". The action has been blocked.
Uncaught TypeError: Failed to execute 'createPolicy' on 'TrustedTypePolicyFactory': Policy with name "emscripten#workerPolicy2" already exists.

---

Most of this PR is finished with AI, but I've confirmed this bug exists and the fix works. Please feel free to reject if you find it unacceptable.

I haven't included a test case, as I am not familiar with the test suite. I would appreciate any guidance or help from maintainers to add a test.

[sbc100]

Does null not work here? (without the quotes)?

[Young-Lord]

null works. I misunderstood the addFromLibrary function before.
Changed in new commits.

[sbc100]

Put this all on one line. And maybe drop the 1?

[Young-Lord]

Dropped.
However, I found dropping the 1 may break existing CSP trusted-types allowlists that
list emscripten#workerPolicy1 (and pthread's emscripten#workerPolicy1/2). Is that acceptable?

[sbc100]

I have not idea who, if anyone, is using the TRUSTED_TYPES setting, or the implications of changing these strings. @aaronshim originally added this settting. Perhaps they have some insight here?

[Young-Lord]

The CI failure in test-core3 seems irrelevant, since TRUSTED_TYPES is not even enabled for it.