Block insecure script running in a data: frame when the top-level page is HTTPS.

This is done to prevent navigation of window.top and is required if
we are to treat frames as active content.  The alternative would be
to roll back the treatement of frames as such, which is undesirable.

Although the bug presents the example using iframes, it is easier to
test using a combination of script and iframe.  Both go down the same
active content path.

BUG=310794

Review URL: https://codereview.chromium.org/38373002

git-svn-id: svn://svn.chromium.org/blink/trunk@160453 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Refactoring: Decouple ContentSecurityPolicy from ExecutionContext.

This is a preparation for Document-ExecutionContext decoupling.
ContentSecurityPolicy assumes Document inherits EC, which will
no longer true in a coming change. This change replaces
EC pointer with one of ExecutionContextClient so that the coming change
don't require big change in this class.

R=tkent, abarth, dglazkov
BUG=305497

Review URL: https://codereview.chromium.org/39923002

git-svn-id: svn://svn.chromium.org/blink/trunk@160454 bbb929c8-8fbe-4397-9dbb-9b2b20218538
DevTools: emulates tab in drawer

BUG=310988
R=vsevik@chromium.org

Review URL: https://codereview.chromium.org/37213003

git-svn-id: svn://svn.chromium.org/blink/trunk@160455 bbb929c8-8fbe-4397-9dbb-9b2b20218538