Associate CSP with NullPrincipal

iframe sandbox uses NullPrincipa, which currently ignores CSP
CSP should not hold owning reference to channel

CSP was holding strong reference to both the http channel and channel
principal. However, the principal has a strong reference to the CSP
policy. Since the channel and principal should outlive the policy, we
only need a weak reference to them.
export ContextHolder
basic sandbox implementation
using CSP to restrict Sandbox XHR
refactor sandboxes from content sandbox-mode
cross-compartment communication: sandbox both ends
bugfix: compare principal origins not uris

since a page http://a.com/w00t should == http://a.com
reduce label given privs
get underlying principal origin
don't raise label if we're in content

- Use principal as privilege to avoid raising label too high
- Enable sandbox-mode if it's not when performing read
- Disallow reads from non-sandboxed compartments
Use CSP to restrict network access when raising label
wip; set underlying principal; going to try to set csp for null principal
make compile with head
Port to use JS::Heap<>

TODO: double check that unsafeGet is actually safe as used.
change underlying principal when raising label