Added language about GUID URI schemes.

Mike and Dan, 

 I believe this text reflects the current consensus that GUID URI schemes should never match a * policy and must be explicitly listed, with warning text but not normative equivalence to unsafe-inline and unsafe-eval.