CSP: Clarify/Allow '*' and scheme-based policies #515

Is your feature request related to a problem? Please describe.

We have a b2b SaaS that allows customers/tenants to load non-script resources from customer-managed domains. Listing the domains all up-front in a CSP policy is not practical as there are many (hundreds or more) and they are dynamic (customers
can change them).

The HTTP Content-Security-Policy header supports:

• connect-src https: — allow connections to any HTTPS origin
• connect-src * — allow connections to any origin

Neither is explicitly denied by this spec, but nor are they mentioned as supported. Current host implementations (Claude, ChatGPT) silently drop them.

Describe the solution you'd like

The spec should clarify what values are valid in connectDomains, resourceDomains, etc. The CSP construction template in the spec joins values directly into the header string, implying any valid CSP source expression should work. But hosts are silently rejecting anything that isn't an origin URL.

Specifically, the spec should:

1. Define the set of allowed source expressions (origins, scheme-sources like https:, wildcards like https://*.example.com, *)
2. Require hosts to support at least scheme-sources (https:) in connectDomains, since this is a standard CSP feature and the only practical way to allow connections to a dynamic set of domains.

Describe alternatives you've considered

Proxying all requests through our own domain. This is inefficient and expensive.

Additional context

Relevant spec section: "CSP Construction from Metadata" — the TypeScript template joins domain arrays as-is, which suggests scheme-sources should work.