fix(webapi): adapt Trusted Types and worker security bindings

Identify Trusted Types through shared native interface identities and
validate imported Worker script responses through the complete-head API.
Preserve the initiating origin, mode, credentials and security policy.

Validation: cargo fmt --all; cargo clippy --workspace --all-targets
--all-features -- -D warnings; cargo nextest run --no-fail-fast
(18011 passed, 13 skipped).

moli-renderer-v8/src/context_bootstrap/trusted_types.rs

@@ -705,13 +705,9 @@ pub(crate) fn trusted_type_kind<'s>(
     value: v8::Local<'s, v8::Value>,
 ) -> Option<TrustedTypeKind> {
     let object = v8::Local::<v8::Object>::try_from(value).ok()?;
-    let kind = get_private_value(scope, object, TRUSTED_TYPE_KIND_SLOT)?;
-    match kind.to_string(scope)?.to_rust_string_lossy(scope).as_str() {
-        "html" => Some(TrustedTypeKind::Html),
-        "script" => Some(TrustedTypeKind::Script),
-        "script-url" => Some(TrustedTypeKind::ScriptUrl),
-        _ => None,
-    }
+    TRUSTED_TYPE_KINDS
+        .into_iter()
+        .find(|kind| kind.interface().is_instance(scope, object))
 }
 
 pub(crate) fn trusted_type_string<'s>(

moli-renderer-v8/src/worker/global_scope/import_scripts.rs

@@ -241,11 +241,9 @@ pub(super) fn fetch_worker_import_source_blocking(
             response.body_bytes(),
         )?;
         if let Some(initiator_url) = &request_initiator_url {
-            validate_fetch_response_security_policy_for_origin(
-                initiator_url,
-                &WebOrigin::from_url(initiator_url),
-                &response.final_url,
-                &response.headers,
+            validate_fetch_response_security_policy(
+                WebOrigin::from_url(initiator_url),
+                &response.head(),
                 RequestMode::NoCors,
                 RequestCredentialsMode::SameOrigin,
                 policy_context,