Should the APIs for creating a TrustedScript etc return a frozen object?

[lukewarlow]

Currently the TrustedTypes aren't frozen objects so can be overridden. And then we need to account for the fact stuff like the stringifier can be overriden in implementations. We should probably change the spec to freeze the trusted types upon creation?

I'm not sure spec wise the correct way to do this. But I'm assuming we can call a freeze algorithm with the object even if there's not an IDL way to say this?

cc @koto

[lukewarlow]

This came up during implementation of eval protection within JSC. Where having a frozen object should help improve performance.