[Runtime] Add CSP parsing handler for manifest.json

The CSP information will be parsed and stored in ApplicationData so that
other components can use the structured information instead of the raw
data from manifest.json.

The specification can refer to the W3C Content Security Policy 1.0 spec:
https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-1.0-specification.html