Use trusted types for script URL (#1642)

Create a policy which appends the test extensions to the URL.
This does not make the script safer, but it does limit the security risk
to the code inside the `createPolicy` call which, in theory, should be
easier to review.
2 files changed