Make dynamically-added favicons (via link rel="icon") obey Content-Security-Policy.  This is the spec'd behaviour.

BUG=266304
R=abarth@chromium.org

Review URL: https://chromiumcodereview.appspot.com/20920003

git-svn-id: svn://svn.chromium.org/blink/trunk@155362 bbb929c8-8fbe-4397-9dbb-9b2b20218538