CSP 1.1: Remove the script interface to the set of enforced policies.

The current API is poor, and not what we'd like to run with going
forward. Alex Russell and Yehuda Katz have strongly argued for and
outlined a better take on an API ([1], [2]). Removing the current
definition to make room for a future definition along the lines of
their proposals.

This patch does not, however, remove the event fired upon violation
of the set of currently active policies. That seems to stand alone
quite cleanly.

[1]: http://infrequently.org/2013/05/use-case-zero/
[2]: http://yehudakatz.com/2013/05/24/an-extensible-approach-to-browser-security-policy/
CSP 1.1: Add hash and nonce usage notes to 'style-src'.

Only non-normative changes to make it clear from the outline that hashes
and nonces do in fact apply to style as well as script.
CSP 1.1: Remove 'experimental' label from the draft.

In the hopes of getting to last call sometime in the relatively near
future, this patch removes the 'experimental' label from the pieces of
the draft that seem ready for real discussion.

The <meta> bits are still labeled as experimental, as there's a big fat
TODO sitting there waiting to be TODONE.
CSP 1.1: Clean up the <meta> definition.

This patch specifies the details of a few long-standing TODOs in the
definition of CSP's handling of policies defined by <meta> elements.
In particular, 'sandbox' and 'report-uri' directives are ignored[1]
We should add 'frame-options' (or 'frame-ancestors'?) here as well
if/when it is added to the spec.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2013Jun/0057.html
CSP 1.1: "CSP policy" -> "policy"

The department of redundancy department is likely displeased with
this change, but so it goes.