Understandably, this PR is heavily focused on the mechanical aspects of the updated (default) CSP directive. For context, I'd like to emphasize that CSP is merely an implementation detail to achieve the goal of defaulting to secure requests. The documentation is technically accurate, but possibly not easy to find for those who are looking for a way to make network requests.

The feedback below is feedback on the documentation as written; I'd like to see a follow-up that links the information from a more obvious place.

Performing network requests is a very common need in browser extensions, but we don't have any page like that at all. For the lack of anything better, we currently bury some permission requirements under https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/host_permissions (and for MV2, https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions). These pages along with the new CSP section should be linked from the tutorial that explains how to perform a network request. MDN already has documentation on fetch (https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch), so we only need to explain the relevance of extension-specific details: host permissions, the default CSP (this PR), and that this mostly applies to cross-origin requests from extension contexts (and not content script contexts, which at least in MV3 do not have elevated cross-origin permissions). Here is a dated example of Chrome's documentation (using XMLHttpRequest, which is the ancient predecessor to fetch): https://developer.chrome.com/docs/extensions/mv3/xhr/