enable uri pattern for LoadProvisional autocmd

this prepare a new setting "content-security-policy" that need to be
setted very early (before LoadCommited, where some HTTP-Headers are
already processed by webkit).
new setting 'content-security-policy'

Add a new setting 'content-security-policy', that will set the
'Content-Security-Policy' HTTP-Header on the response, before webkit
processing it.

This setting allow to implement a request-policy based on WebKit
security feature, by whitelisting where the application expects to load
resources.
avoid calling function for check empty string
content-security-policy: add RequestQueued

- add a new autocmd entry: RequestQueued that take place in
  request-queued signal (SoupSession).

- change contentsecuritypolicy_request_queued_cb to
  session_request_queued_cb to be more generic

- append Content-Security-Policy header (instead of remove/replace)

- in DEBUG, abort() if any server headers are setted in request-queued
return of soup_uri_to_string must be free

thank to @fanglingsu
autocmd: add a service function `autocmd_in_use`

The function should permit to check if an AuEvent is actually in use or
not. It would permit to change program behaviour at runtime, and reduce
the overhead of some functions when AuEvent isn't used.
use FEATURE_AUTOCMD for AU_REQUEST_QUEUED

call to autocmd_run need to be conditionnal defined with FEATURE_AUTOCMD
connect `request-queued` signal conditionnally

- add a new function: vb_update_signals()
  it manage signal connection/disconnection

  currently, only `request-queued` is managed. It is connected when
  autocmd use event AU_REQUEST_QUEUED or when setting
  "content-security-policy" is in use.

- remove the unconditionnally connection of `request-queued`

- add a new flag in setting `FLAG_SIGNAL` that inform setting_set_value
  to refresh signals by calling vb_update_signals()

- manage "content-security-policy" setting with `FLAG_SIGNAL`

- refresh signals in autocmd_add, at adding or removing. This permit to
  change the connection/disconnection state of `request-queued` when
  AU_REQUEST_QUEUED is in use or not.
content-security-policy: update documentation

mention RequestQueued as prefered autocmd event for
content-security-policy.
Revert "connect `request-queued` signal conditionnally"

This reverts commit c441ec7aaf4fabc1a32a618bbab3b688d7804628.

As discuted with @fanglingsu, the problem isn't an overhead introduced
by `request-queued` signal. So the conditionnal connection isn"t need.
auto-response-header: generalisation of content-security-policy

auto-response-header supersede previous content-security-policy setting.

This setting is a list of "pattern name=value" entries. When a pattern
match a requested uri, the HTTP header "name: value" is added to
response.
auto-response-header: make value optional

an optional value result removing a previously setted header.
auto-response-header: add FEATURE_ARH

add a compilation flag for disable auto-response-header
auto-response-header: free memory on quit

follow good practices: free the memory allocated before quit
FEATURE_AUTOCMD || FEATURE_ARH: request-queued signal

define and connect request-queued signal only if FEATURE_AUTOCMD or
FEATURE_ARH are defined.
cleanup: autocmd_in_use
cleanup: RequestQueued autocmd Event
cleanup: arh: remove some DEBUG
auto-response-header: man correction

correct mandoc error: unterminated quoted argument
auto-response-header: rewrite arh_parse

`auto-response-header` setting is a list.

Each element has format: "pattern header-list".
If an element contains COMMA, the element must by enclosed by QUOTE.

The header-list format is like `header` setting.