Add more security attributes to the manifest.

I think we need the Caller-Allowable-Codebase attribute so that javascript
bridges work. I also added a Application-Library-Allowable-Codebase.

The full list of security attributes and their meanings:
http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/manifest.html