New Office.js CDN endpoint enables Trusted Types and drops MicrosoftAjax

Independent monitor silentship compared the legacy and new Office.js CDN endpoints: both serve build 16.0.20606.15070 with byte-identical host files, but the new loader sets isOsfSecurityDefaultsEnabled and disables osfLoadMsAjax. As a result, add-ins implicitly relying on MicrosoftAjax (Sys.*, Type.registerNamespace) throw ReferenceError, and pages with strict CSP must allow the officejs policy.

• Both endpoints serve build 16.0.20606.15070 with identical host file hashes
• Only the loader differs: isOsfSecurityDefaultsEnabled = true and osfLoadMsAjax = false
• Add-ins depending on MicrosoftAjax will throw ReferenceError on the new endpoint
• Strict CSP pages must allow the officejs policy and *.static.microsoft