Click to play should override "Any capability blocked in the top document must be blocked in its subdocuments too"
As noted in #43281 (comment 3147431), if a media/webgl/object element is embedded cross-domain, it cannot be enabled by click-to-play unless the respective media
/object
/webgl
capability is explicitly enabled in the top document as well, because on the Tor Browser the Any capability blocked in the top document must be blocked in its subdocuments too (AKA "Cascade restrictions") NoScript setting is on by default.
Unfortunately this is very confusing UX, especially at the Safer
level (see https://blog.mozilla.org/en/products/firefox/firefox-features-fan-favorites/), leading users to believe "click to play is broken".
Since click-to-play permissions are not persisted anyway, I propose to make an exception for permissions given by click-to-play to override "Cascade restrictions", possibly using contextual policies so that the exception applies only to embeddings with that specific top-level origin.