CSP 1.1: Note the role of punycode.

Hosts in source expressions may only contain ASCII characters
due to the sublime joys of Unicode in HTTP headers. This
patch adds a non-normative note to the spec to make it clear
that Punycode (RFC 3492) is the supported mechanism for
internationalized domain names.