feat(client): Add trusted types support

[rictic]

With this change, Karma tests can be run with an enforced Trusted Types policy.

This change consists of using safer APIs (appendChild and textContent instead of innerHTML), as well as creating a policy for client/karma.js which a test's Trusted Types CSP policy can then explicitly allow. This policy is used internally where karma does potentially dangerous operations like loading scripts.

More info about the proposed Trusted Types standard at https://github.com/WICG/trusted-types

[johnjbarton]

I'll try to restart appveyor

[rictic]

For what it's worth, I've run this across all affected tests inside of google3, and all passed

[franktopel]

I cannot find this in the documentation anywhere. How do I enable this feature?

I've tried using

customHeaders: [
    {
        match: '\\.html',
        name: 'Content-Security-Policy',
        value: `require-trusted-types-for 'script';`,
    },
],

and written the following test

it('assigning a string to innerHTML violates the CSP', function() {
    let cspViolated = false;
    window.addEventListener('securitypolicyviolation', () => cspViolated = true);
    document.body.innerHTML = 'foo';
    expect(cspViolated).to.be.true;
    expect(document.body.innerHTML).to.not.equal('foo');
});

Unfortunately, the test fails.