First stab at CSP policy tightening

* Factor out "Associating a resource with a manifest"
* Note HTTP caching and custom caches in "Fetching a manifest"
  and add an example how HTTP cache directives could be used
* Augment "Processing the manifest" with steps to append
  Content-Security-Policy header
* Add "csp member" section

Needs review.