[Runtime] WARP security mode should be enabled by default.

According to the W3C widget spec, http://www.w3.org/TR/widgets-access/,
it said: In the default policy, a user agent must deny access to network
resources external to the widget by default, whether this access is
requested through APIs (e.g. XMLHttpRequest) or through
markup (e.g. iframe, script, img). Means if there's no access tag in
config.xml, all external requests should be blocked.

BUG=XWALK-1772
[Tools] Fixed xwalk_android_gyp issue

according to the chromium upstream patch d9584323 and 50f36a01,
the community decided to stop exporting CHROME_SRC and
ENVSETUP_GYP_CHROME_SRC out of build/android/envsetup.sh, which
will break xwalk_android_gyp.
So we need to get rid of the dependency on those exported variables
in our own script.
Merge pull request #2033 from jondong/envsetup

[Tools] Fixed xwalk_android_gyp issue
Merge pull request #1994 from takethathe/warp

[Runtime] WARP security mode should be enabled by default.