* 'master' of https://github.com/w3c/webappsec-csp: (209 commits)
  Fix a few typos (w3c#280)
  Introduce 'prefetch-src'. (w3c#283)
  Clarify navigation behavior for 'script-src'.
  Incorrect indentation of the navigation check algorithm.
  IDL amendments and small misc issues. (w3c#271)
  Regenerate HTMLs.
  Origin link.
  NoncedElement link.
  link up inline css issue (w3c#228)
  Replaced 'alias' with 'copy' for less ambiguity (w3c#273)
  Cleanup `global object` usage to make sense with `Documents` (w3c#254)
  Elements with duplicated attributes are not nonceable.
  s/not-example.com/example.org/
  Linked testing policy and fixed a few links (w3c#263)
  Rebuild HTML.
  Fix linking errors to 'script-like' and 'applet'.
  Adds WorkletGlobalScope as a concept to CSP. (w3c#205)
  Slight correction of host matching description (w3c#251)
  Fixed ambigous grammar (w3c#250)
  Replace Request.type based logic with Request.destination (w3c#231)
  ...

`Content-Security-Policy: default-src 'self' *.trusted.com` only allows
content from _subdomains_ of trusted.com. This was addressed in the W3C
spec with bug report w3c/webappsec-csp#241 and
associated pull request w3c/webappsec-csp#251 .
Update the code sample to include the root domain as well.

Fixes #1364

`Content-Security-Policy: default-src 'self' *.trusted.com` only allows
content from _subdomains_ of trusted.com. This was addressed in the W3C
spec with bug report w3c/webappsec-csp#241 and
associated pull request w3c/webappsec-csp#251 .
Update the code sample to include the root domain as well.

Fixes #1364