CSP: Move policy parsing out of Document.

This patch finishes the process of allowing policy parsing outside of
an ExecutionContext, and adjusts Document::initContentSecurityPolicy
to accept a ContentSecurityPolicy object rather than a set of headers.
If such an object is provided, the document will take ownership of it
and use it going forward. If no such object is provided, an empty
policy will be created and stored.

A future patch will move parsing out of FrameLoader::didBeginDocument
into DocumentLoader::responseReceived so that we can begin doing some
checks before a document is created.

BUG=411889

Review URL: https://codereview.chromium.org/559503002

git-svn-id: svn://svn.chromium.org/blink/trunk@181811 bbb929c8-8fbe-4397-9dbb-9b2b20218538