Clarify distintion between unsafe-eval and wasm-eval

[pauljt]

In the proposal, is intent that 'unsafe-eval' ALSO enables all WebAssembly functions, as well as the proposed wasm-eval keyword (but not vice versa)? Or is wasm-eval supposed to act independently.

[eholk]

Currently 'unsafe-eval' allows WebAssembly and all of the other things that fall under 'unsafe-eval', and we are not planning to change this behavior. The goal for 'wasm-eval' is to allow WebAssembly without allowing JS eval().

Basically, 'unsafe-eval' implies 'wasm-eval', but 'wasm-eval' does not imply 'unsafe-eval'.

[eholk]

See w3c/webappsec-csp#293 for a PR to specify 'wasm-eval' in the CSP spec.

[titzer]

I believe this should be clear from the current text now.