Similar to #457 but about trusted-create-element.
Steps to reproduce:
- Add this rule:
youtube.com#%#//scriptlet('trusted-create-element', 'head', 'script', '', 'alert(1)')
- Go to - https://www.youtube.com/
Alert message should be displayed but adding a script is blocked by Trusted Types.
Screenshot

Adding trustedTypes.createPolicy to scriptlet probably should fixes it.
Issue occurs in Chromium based browsers but doesn't occur in Firefox because it doesn't support Trusted Types API.