introduce DirectiveSet class

This commit changes the constructor of ContentSecurityPolicyListener
but I don't consider this to be a public API. The public API is just
the configuration.