Remove deprecated plugin-types CSP directive

[Copilot]

The plugin-types directive was removed from the CSP specification and browser support was dropped years ago. This removes it from secure_headers.

Changes:

• Removed PLUGIN_TYPES constant and directive from DIRECTIVES_2_0
• Removed :media_type_list validation type and validate_media_type_expression! method
• Removed plugin_types from README configuration example
• Removed validation tests for plugin-types

Migration:
Configurations using plugin_types will now raise ContentSecurityPolicyConfigError for unknown directive. Remove the directive from your CSP configuration:

# Before
config.csp = {
  default_src: %w('self'),
  plugin_types: %w(application/pdf),  # Remove this line
  script_src: %w('self')
}

# After
config.csp = {
  default_src: %w('self'),
  script_src: %w('self')
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• coveralls.io
  • Triggering command: /usr/bin/ruby3.2 ruby3.2 /home/REDACTED/work/secure_headers/secure_headers/vendor/bundle/ruby/3.2.0/bin/rspec spec/lib/secure_headers/headers/policy_management_spec.rb /tmp/cc7d9JqQ.s conf�� by-3.2.0 --global ism-1.6.0/include user.email ism-1.6.0/ext (dns block)
  • Triggering command: /usr/bin/ruby3.2 ruby3.2 /home/REDACTED/work/secure_headers/secure_headers/vendor/bundle/ruby/3.2.0/bin/rspec token_type.o /tmp/ccdmjqra.s vend�� in.so /lto-wrapper /home/REDACTED/.ca-I kward (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Validation on plugin-types does not allow for the empty directive</issue_title>
<issue_description># Bugs

Note: The plugin-types grammar allows for an empty directive value in which case all instantions of embed and object will fail.

https://w3c.github.io/webappsec-csp/#directive-plugin-types

We validate it must match something like application/pdf which is not correct.

Expected outcome

Describe what you expected to happen

plugin_types should allow for an empty directive. Sending an empty array omits the directive. Sending none is not allowed by validation. An array of empty strings doesn't work either (validation)

Actual outcome

Configuration errors when trying to do the right thing

</issue_description>

<agent_instructions>Based on this comment (#448 (comment))

It looks like the plugin-type directive was removed. Can you remove the plugin-type directive and associated tests?</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@fletchto99 It looks like the `plugin-type` directive was removed. Perhaps instead we should remove it from secure_headers? From what I can tell only webkit and chrome supported it and removed support a few years ago.

cc https://issues.chromium.org/issues/40164809
cc w3c/webappsec-csp#456</comment_new>

• Fixes Validation on plugin-types does not allow for the empty directive #448

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.