[mediaqueries-5] Account for CSP restrictions in the scripting feature

Regarding the @media scripting features, value none, the current specification reads:

[...]the value of the scripting media feature should be enabled or initial-only if scripts originating on the same domain as the document are allowed to run, and none otherwise.

Security and privacy browser extensions such NoScript, uBlock Origin or uMatrix currently use CSP directives (typically script-src and script-src-elem) to turn off JavaScript on certain sites of users' choice, and use DOM manipulation to display the content of <noscript> elements (which are not affected by CSP) and provide users with the authors' intended feedback. Of course the JavaScript-toggled CSS classes approach works out of the box.

It would be great if this new feature took in account CSP disabling script execution on the document, making explicit that the value should be none for that case. Otherwise the aforementioned tools would need to scan all the CSS rules applied to the page and manipulate them to force those matching scripting none, which would a ugly, inefficient hack.

Start with the Media Queries Level 5 definition of the scripting media feature, especially the none value, and review the issue's CSP examples involving script-src and script-src-elem. Done means reaching agreement on the CSP interaction and updating the specification's normative wording accordingly.