This PR introduces a new __VUE_PROD_TRUSTED_TYPES__ feature flag to enable support for Trusted Types. Addressing vuejs/rfcs#614.

For Trusted Types, I created a vue policy to convert the HTML string output from the Vue compiler to the TrustedHTML type.
This implementation works with the current enforcement of Google Workspace products without any issue.

In some rare circumstances, where the user explicitly configured allowed policy names and not allowing duplicates (Content-Security-Policy: trusted-types vue <their-custom-policy>; without a trailing allow-duplicates), a second version of Vue on the same web page would fail to create the built-in trusted types policy.
This may be solved by allowing users to customize the built-in policy name, but I don't think it's worth the complexity at this moment, considering the low adoption rate of this feature.

Note that the in-browser compiler doesn't benefit from this PR because it's already incompatible with many content security policies anyway.

Remaining todos:

• Add a section in https://vuejs.org/guide/best-practices/security.html about trusted types compatibility, we can take https://angular.io/guide/security#enforcing-trusted-types as an example.