Clarify the $csp rules usage

1. $csp rules use the regular matching algorithm. e.g. `$csp=script-src 'none',domain=example.org` **will** match the `https://example.org`: https://github.com/AdguardTeam/AdguardBrowserExtension/issues/1474.
2. $csp rules are applied to `DOCUMENT` resources only: https://stackoverflow.com/questions/54203764/content-security-policy-csp-header-onto-each-file-or-only-the-actual-html-pag:
> "The resources which can be requested (and subsequently embedded or executed) on behalf of a specific **Document or Worker**"

We should figure out what to do with the Workers part. It seems that it does not really work in Chrome, only in FF.