Clarify how this behaves with script-src-attr, script-src-elem and worker-src.

[antosart]

In the explainer there is an open question on whether script-src-v2 should override or not script-src. It would be helpful to consider also how it should relate to worker-src, script-src-elem and script-src-attr, which fall back to script-src when not specified.

[carlosjoan91]

For elem and attr, see my response in #6

worker-src is a bit more complicated due to the interaction with child-src. For that what we can do is modify the fallback algorithm so the fallback chain for worker-src is now conditional on whether or not script-src-v2 is set. Something like:

If script-src-v2 is set
  Return << "worker-src", "child-src", "script-src-v2", "default-src" >>.
else
  Return << "worker-src", "child-src", "script-src", "default-src" >>.

[antosart]

I assume that url hashes would then apply when loading workers, right?

[carlosjoan91]

Correct, hashes would be supported for workers as well