Misleading recommendation for CSP directive "frame-src"

#2689277: Add ability to configure the child-src CSP directive added support for the CSP directive "child-src", and added this recommendation when editing the directive "frame-src" in the admin form:

This directive is deprecated and will be replaced by child-src. It is recommended to use the both the frame-src and child-src directives until all browsers you support recognize the child-src directive.

The preferred method is now to use "frame-src", see:

• https://w3c.github.io/webappsec-csp/#changes-from-level-2
• https://www.drupal.org/project/seckit/issues/2689277#comment-12295114
• https://stackoverflow.com/questions/30023608/how-to-use-frame-src-and-ch...
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Securi...

Remove the recommendation and leave the option to use both "frame-src" and "child-src" ? Both are valid: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Securi...