[CSP] keyword-source rule's 'self' definition should allow for websocket connections to the same origin

[zdexter]

Scenario: You are developing a web application that talks to HTTPS and WSS endpoints. You would like to specify connect-src 'self' so that you can make XHR requests. You would also like to make websocket requests to the same server.

Because 'self' matches host, port and scheme, this is impossible unless you enumerate or match all domains that the WSS server might run on. Many modern web applications use both HTTP and websockets; you establish an HTTP connection, download some assets, then establish a websocket connection.

The utility of 'self' is that you don't have to enumerate or match all possible domains - but this utility is unavailable if the application expects users to make websocket connections from their browsers.

[zdexter]

Oops, looks like this is already tracked here: w3c/webappsec-csp#7