Incorrect assertion within Example 18

[lukewarlow]

Example 18 states:

An empty directive value indicates policies may not be created, and sinks expect Trusted Type values, i.e. no DOM XSS injection sinks can be used at all.
Content-Security-Policy: trusted-types; require-trusted-types-for 'script'

However, the fromLiteral tagged template function allows you to create a trusted type without any allowed policies afaict. This example should be updated to clarify this.

[lukewarlow]

THis might be irellevant depending on #398

[koto]

Added a comment to the example. Will remove together with other fromLiteral references, depending on #398.