CSP 1.1: Drop auxiliary browsing context bits from 'child-src'

Dealing with popups is going to take a little bit more thought than
we have time for in 1.1. Punting 'window.open' to 1.2, both becuase
it's complex, and because it's outside the scope of functionality
that we voted to close back in October.