SI: Adding lcamtuf's attack scenario.
SI: Limit resources eligible for integrity validation.

As discussed in [1], we ought to limit the ability of attackers to read
resource values cross-origin via brute-force attacks using the integrity
validation mechanisms. This patch implements lcamtuf/mnot's suggestions
in this regard.

It's possible that we ought to make this even more stringent by dropping
the "publically cachable" bits in favor of strict CORS checking. That
will certainly be a topic of discussion going forward.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2014Jan/0025.html
SI: Add details on an integrity cache-enabled CSP bypass.

Noted initially by Ben Towes on public-webappsec@ (no URL, as Ben
wasn't a member of the list when he posted).
Merge pull request #2 from deian/master

update sandbox flag list
SI: Fixing some typos.

Patch from Caleb Queern.
Regenerating.
Clarify intent of use-case #2.
Fixing "cachable by a shared cache" link.
Drop "CORS same-origin" from eligibility check.
SI: Resource's _URL's_ scheme...
SI: Don't block rendering if integrity policy isn't `block`.
SI: Block `progress` events on XHR.
SI: Add MIME types to examples.
SI: Add note about `Access-Control-Allow-Credentials`.
SI: Regenerate draft.
SI: Limit header addition to basic fetches.
SI: Don't pollute the list of global attributes.

As Anne suggested in [1], we now list all the elements and interfaces
which `integrity` attributes should be added to, rather than leaning
on the global list of attributes.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2014Jan/0062.html
SI: Note that servers should respond with `CC: no-transform`.
SI: Group use-cases for clarity.

1, 2, 4, and 5 are different takes on the same feature. 3 and
6 are distinct, and we should make that clear in the doc.
CSP 1.1: Merge `popup-src` and `worker-src` into `child-src`. Deprecate `frame-src`.