Split CSP policy lists on a bare comma, not just ", "

[durvesh1992]

Summary

getCSPHeadersFromWebRequestResponse splits a combined CSP header into individual policies only when the value contains ', ' (comma + space):

if (header.value?.includes(', ')) {
  header.value.split(', ').forEach(/* ... */);
} else {
  individualHeaders.push(header);
}

Per CSP3 §parse a serialized CSP list the separator is a bare U+002C COMMA; the surrounding whitespace is optional. So a server sending

Content-Security-Policy: default-src 'self';,script-src 'self';

is left as a single combined string. parseCSPString then splits it on ;, yielding a ,script-src directive token with a stray leading comma that never matches script-src. The script-src policy is silently dropped, which weakens the eval/worker CSP checks that depend on detecting it — a correctness gap in a security extension.

Fix

Split on , and trim() each policy (dropping empty entries). Inputs using the conventional ', ' separator produce identical output, so this is backwards compatible.

Test plan

Added a regression test for a policy list separated by a comma with no space. Verified it fails before the change and passes after.

• Full suite: 11 passed, 98 tests passed (was 97), no regressions.
• Prettier clean.