feat(workers): add support for trusted types

[sorin-davidoi]

Using fuse.js/worker currently fails for projects that use the require-trusted-types-for Content Security Policy directive:

This document requires 'TrustedScriptURL' assignment. The action has been blocked.
_spawnWorker @fuse-worker.mjs:73
_init        @fuse-worker.mjs:107
_ensureInit  @fuse-worker.mjs:69
search       @fuse-worker.mjs:130

This patch fixes this by creating a TrustedTypePolicy called fuse-trusted-worker-url and spawning the web workers with a TrustedTypeURL instance created from the policy.

It also changes the public API to allow workerUrl to be passed as a TrustedScriptURL, such that consumers can use their own policies.

This change should have no impact on consumers that don't make use of the require-trusted-types-for directive.

See https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API.

Inspired by sveltejs/svelte#16271.

[krisk]

Thanks for this, the CSP gap is real and definitely should be fixed. Two blockers:

1. The published types break. TrustedScriptURL isn't in TS's lib.dom.d.ts and @types/trusted-types is a devDependency, so consumers get TS2304: Cannot find name 'TrustedScriptURL' off dist/fuse-worker.d.ts. That's why package-types.test.ts needed types: [] -> types: ['trusted-types'], but catching that is the whole point of that test. Can you declare a local structural interface instead ({ toString(): string; toJSON(): string })? Keeps the .d.ts self-contained and drops the dep and tsconfig changes with it.

2. createPolicy at module scope can throw on import. It throws when a trusted-types directive doesn't allow-list the name, or on a duplicate name without allow-duplicates. So trusted-types myapp; require-trusted-types-for 'script' crashes on import 'fuse.js/worker', which is the audience for this PR. Make it lazy in the constructor, memoized, in a try/catch that falls back to the plain URL.

Two smaller ones: globalThis.trustedTypes?. rather than gating on window (skips worker scopes), and I'd wrap a consumer-supplied workerUrl too since the policy is identity, otherwise the escape hatch in the docs still throws under CSP.

Also needs a rebase, dist/ has moved since 457fe762.