CSP sandbox allow-same-origin - clarify

[hamishwillee]

If found the description of the CSP sandbox value allow-same-origin to be a little confusing. This rewords to match the pattern of the other values, and adds the note that the Origin header will be null if this is not set.

This fell out of reviewing #40093

Fixes #40094

[github-actions]

Preview URLs

• /en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/sandbox

Flaws (3)

URL: /en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/sandbox
Title: Content-Security-Policy: sandbox directive
Flaw count: 3

• unknown:
  • No generic content config found
  • no blog root
  • no blog root

[Josh-Cena]

1. Perhaps you could use this chance to fix The Content-Security-Policy: sandbox allow-same-origin section has some ambiguity #40094?
2. Mention that Content-Security-Policy: sandbox can lead to Origin: null #40093 has a grammatical error; it should be "that doesn't".

[hamishwillee]

I already fixed the second in another issue. The first outlines a number of problems, the only one that is valid (Origin) is already fixed. I've added "Fixes" above for that. Nothing else to do.

[bsmth]

Tough one to summarize, is this any better?

Suggested change

	- : Allows a same-origin sandboxed resource to be treated as same-origin, reducing the restrictions normally applied to a sandbox.
	If this token is not used, the resource is treated as being from a special origin that always fails the {{Glossary("same-origin policy")}} (potentially preventing access to [data storage/cookies](/en-US/docs/Web/Security/Same-origin_policy#cross-origin_data_storage_access) and some JavaScript APIs).
	- : Allows a sandboxed resource to maintain its {{Glossary("origin")}}.
	A sandboxed resource is otherwise treated as being from an origin that always fails {{Glossary("same-origin policy")}} checks, which prevents access to [`localstorage` and `document.cookie`](/en-US/docs/Web/Security/Same-origin_policy#cross-origin_data_storage_access) and some JavaScript APIs.

causes the content to be treated as being from its real origin instead of forcing it into an opaque origin;

• https://html.spec.whatwg.org/multipage/browsers.html#sandboxed-origin-browsing-context-flag

[bsmth]

Suggested change

	The {{httpheader("Origin")}} of such a request would be `null`.
	The {{httpheader("Origin")}} of sandboxed resources without the `allow-same-origin` keyword is `null`.