CSP 1.1: Workers may have their own policies.

According to [1], we have consensus that web workers ought not always
inherit their owner documents' set of policies, but instead be governed
by whatever policy is delivered along with the worker's script.

Workers should inherit their owner document's set of policies only when
they are created from URLs with unique origins (such as the various
types of non-hierarchical URLs we care about: blob, filesystem, data,
etc.).

This patch attempts to clarify that, and also clarifies that
'importScripts' ought to be filtered through the currently active set of
policies.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2013Dec/0007.html
CSP 1.1: Add 'child-src', 'worker-src', and 'popup-src'.

Since workers create child browsing contexts, [1] proposes that their
threat model is more similar to frames than to scripts, and that they
should be governed appropriately. Given that they now may be delivered
with their own policies (again, like documents in frames), this claim
makes even more sense.

This patch synthesizes the two proposals made in [1] by adding new
'worker-src' and 'popup-src' directives to govern the execution contexts
created by workers and the auxiliary browsing contexts created by popups
respectively. A 'child-src' directive is also introduced, which sets up
default source lists for 'frame-src', 'popup-src', and 'worker-src'.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2013Dec/0007.html