First load (from bundle/proxy, CSP injected)

This document is served via IsolatedWebAppURLLoaderFactory and has the mandatory IWA CSP injected (script-src 'self', require-trusted-types-for 'script', etc).

It registers a service worker. After the SW activates and claims this client, reload the page: the SW will intercept the navigation and synthesize a response that has NO CSP.