Implement CSP check for manifest fetching

The CSP bits include the 'manifest-src' directive, but _not_ the
forthcoming "manifest that sets a CSP for its documents" feature.

BUG=366145

Review URL: https://codereview.chromium.org/570563003

git-svn-id: svn://svn.chromium.org/blink/trunk@183317 bbb929c8-8fbe-4397-9dbb-9b2b20218538