CSP 1.1: Clarify "element's contents" intent.

This block describes the value of "element's contents" for both script
and non-script elements. Adding the words "non-script" and "style"
explicitly to make things clear. Brief discussion in [1].

[1]:
http://lists.w3.org/Archives/Public/public-webappsec/2013Dec/0071.html
CSP 1.1: Clean up 'nonce-value' and hash algorithm.

This patch adds 'nonce-value' back to the grammar, and adds base64
encoding to the hashing algorithm, cleaning up the breakage that
both omissions introduced.

Patch submitted via [1].

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2013Dec/0056.html
CSP 1.1: Denormify the hash mismatch warning.

We don't really want to have normative requirements for things like
console messages. Changing the SHOULD to a non-normative note.
CSP 1.1: Remove the script interface to the set of enforced policies.

The current API is poor, and not what we'd like to run with going
forward. Alex Russell and Yehuda Katz have strongly argued for and
outlined a better take on an API ([1], [2]). Removing the current
definition to make room for a future definition along the lines of
their proposals.

This patch does not, however, remove the event fired upon violation
of the set of currently active policies. That seems to stand alone
quite cleanly.

[1]: http://infrequently.org/2013/05/use-case-zero/
[2]: http://yehudakatz.com/2013/05/24/an-extensible-approach-to-browser-security-policy/
CSP 1.1: Add hash and nonce usage notes to 'style-src'.

Only non-normative changes to make it clear from the outline that hashes
and nonces do in fact apply to style as well as script.
CSP 1.1: Remove 'experimental' label from the draft.

In the hopes of getting to last call sometime in the relatively near
future, this patch removes the 'experimental' label from the pieces of
the draft that seem ready for real discussion.

The <meta> bits are still labeled as experimental, as there's a big fat
TODO sitting there waiting to be TODONE.
CSP 1.1: Clean up the <meta> definition.

This patch specifies the details of a few long-standing TODOs in the
definition of CSP's handling of policies defined by <meta> elements.
In particular, 'sandbox' and 'report-uri' directives are ignored[1]
We should add 'frame-options' (or 'frame-ancestors'?) here as well
if/when it is added to the spec.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2013Jun/0057.html
CSP 1.1: "CSP policy" -> "policy"

The department of redundancy department is likely displeased with
this change, but so it goes.
CSP 1.1: Add citation for HTML Imports.