Start splitting up ContentSecurityPolicy.  WIP

Still not done but split out a bunch so far.  Factorized with
.build instead of calling .new to get the right class.  Still
struggling with the browser ivar.

I think the factory could further split the FF into 2 classes
for standard and non-standard, to further kill conditional checks
in the class.  Perhaps it should call a class method like .buildable?
on classes so it can roll through and pick the first that responds true.