[JSC] Script run from an isolated world should bypass a page's CSP
https://bugs.webkit.org/show_bug.cgi?id=100815

Reviewed by Oliver Hunt.

Source/WebCore: 

* bindings/js/ScriptController.cpp:
(WebCore::ScriptController::shouldBypassMainWorldContentSecurityPolicy):
* bindings/js/ScriptController.h: Test the current caller's DOM wrapper
world to decide whether CSP should be enforced.

Like most of CSP, this is a stupid policy because it doesn't address
second-order effects like <script> parsing or event handler execution,
which might be triggered indirectly by privileged scripts. These indirect
effects are still broken. Oh well.

LayoutTests: 

Enabled these tests, now that they pass.

I removed all the nonsense in these tests about setting an isolated world's
CSP and origin manually, since we have no use for those features.

* http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt:
* http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt:
* http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html:
* http/tests/security/isolatedWorld/bypass-main-world-csp.html:
* platform/efl/TestExpectations:
* platform/mac/TestExpectations:
* platform/qt/TestExpectations:
* platform/win/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148076 268f45cc-cd09-0410-ab3c-d52691b4dbfc