Add policy container to request

fetch.bs

@@ -20,6 +20,7 @@ url:https://tools.ietf.org/html/rfc7234#section-1.2.1;text:delta-seconds;type:df
 url:https://tools.ietf.org/html/rfc8941#section-2;text:structured field value;type:dfn;spec:rfc8941
 url:https://tools.ietf.org/html/rfc8941#section-4.1;text:serializing structured fields;type:dfn;spec:rfc8941
 url:https://tools.ietf.org/html/rfc8941#section-4.2;text:parsing structured fields;type:dfn;spec:rfc8941
+urlPrefix: https://html.spec.whatwg.org/;type:dfn;text:clone a policy container
 </pre>
 
 <pre class=biblio>
@@ -1519,6 +1520,14 @@ user-agent-defined object). Unless otherwise stated it is null.
 <a lt=fetch for=/>fetching</a>. It provides a convenient way for standards to not have to set
 <a for=/>request</a>'s <a for=request>origin</a>.
 
+<p>A <a for=/>request</a> has an associated <dfn export for=request
+id=concept-request-policy-container>policy container</dfn>, which is "<code>client</code>" or a <a
+for=/>policy container</a>. Unless stated otherwise it is "<code>client</code>".
+
+<p class="note no-backref">"<code>client</code>" is changed to a <a for=/>policy container</a>
+during <a lt=fetch for=/>fetching</a>. It provides a convenient way for standards to not have to set
+<a for=/>request</a>'s <a for=request>policy container</a>.
+
 <p>A <a for=/>request</a> has an associated
 <dfn export for=request id=concept-request-referrer>referrer</dfn>, which is
 "<code>no-referrer</code>", "<code>client</code>", or a <a for=/>URL</a>. Unless stated otherwise it
@@ -3659,6 +3668,19 @@ steps:
  <a for=request>current URL</a> is not <a lt="is local">local</a>, then set <var>response</var> to a
  <a>network error</a>.
 
+ <li>
+  <p>If <var>request</var>'s <a for=request>policy container</a> is "<code>client</code>", then:
+
+  <ol>
+   <li><p>If <var>request</var>'s <a for=request>client</a> is non-null, then set
+   <var>request</var>'s <a for=request>policy container</a> to a <a
+   lt="clone a policy container">clone</a> of <var>request</var>'s <a for=request>client</a>'s <a
+   for="environment settings object">policy container</a>. [[!HTML]]
+
+   <li><p>Else, set <var>request</var>'s <a for=request>policy container</a> to a new <a
+   for=/>policy container</a>.
+  </ol>
+
  <li><p>Run <a>report Content Security Policy violations for <var>request</var></a>.
 
  <li><p><a>Upgrade <var>request</var> to a potentially trustworthy URL, if appropriate</a>.