[Runtime] Add CSP supporting for Crosswalk scheme

The CSP control will be enabled in packaged application by adding the
CSP content into the Crosswalk scheme response header.

The CSP policy is coming from "content_security_policy" field in
manifest.json, so web application developer could configure it as they
want.

https://crosswalk-project.org/jira/browse/XWALK-630
[Runtime] Disable the default CSP policy

Remove the default CSP policy: script-src 'self'; object-src 'self',
since it will block many tests and applications.