Rename BrowserPolicy framing functions.

Orient them around the default policy, which is app can be framed by any origin.
Separate browser policy functions into two packages.

* browser-policy uses browser-policy-framing and browser-policy-content, both of
  which set default policies when they are used. This way you get a default
  policy when you add a browser policy package, but you can pick and choose
  different packages if you only want to think about one of them.
* The two packages use different namespaces: BrowserPolicy.framing and
  BrowserPolicy.content, which meant some functions got renamed (e.g. not using
  "framing" or "content in the function name when it's already in the
  namespace).
Cache csp instead of constructing it each request.
Actually save csp in cachedCsp.

Also rename ensureDirective to prepareForCspDirective to make it clearer that it
clears cachedCsp.
Tweak browser-policy-framing docs
Move meteor_runtime_config.js pathname check first
Merge branch 'browser-policy-tweaks' into devel