CSP Directive Check

Write cspAllows(policy, kind) — policy is a CSP string like "default-src 'self'; img-src 'self' data:"; kind is "script" | "img". Scripts need a script-src directive (falling back to default-src); images use img-src or default-src. Return true when the directive's source list contains 'self' or data: — false otherwise (including when no directives exist at all).

Difficulty: intermediate