[adrianbj]

Fixes #616.

On a page whose Content-Security-Policy includes require-trusted-types-for 'script', the browser refuses plain strings at innerHTML, insertAdjacentHTML, a script's src, and a script's text. Debug.init() throws on its first innerHTML, so no bar appears at all.

This adds Tracy.trusted to helpers.js. It runs first in all three bundles: the bar, the BlueScreen, and Dumper::renderAssets(). It creates a tracy policy once per window, and the ten sinks pass their strings through it:

• bar.js: the panel content, the popup window's body and script, the layer, AJAX panels and rows, loadScript(), and evalScripts()
• dumper.js: createEl()
• bluescreen.js: loadAjax()

The policy passes everything unchanged. These strings are Tracy's own server-rendered markup, which is already escaped where it needs to be.

Behavior is unchanged when:

• the browser has no Trusted Types support
• the page doesn't require Trusted Types
• the page's trusted-types directive doesn't allow the tracy name; strings are passed as before, so a site that restricts policy names needs to add tracy to its list

Tested with Chrome against the examples on v2.13 (the four JS files are identical to master's), with require-trusted-types-for 'script' enforced:

	before	after
barDump.php: bar, panels, dump expansion, panel opened in a new window	TypeError in Debug.init(), no bar	renders, 0 violations
ajax-fetch.php: AJAX row, AJAX error BlueScreen	no bar	new row added, BlueScreen shown, 0 violations
dump.php	bar throws	9 dumps rendered, 0 violations
exception.php	bar throws	BlueScreen rendered, 0 violations

I couldn't run npm run lint locally.