CSP: Fire 'load' events even when blocking loads via 'frame-src'.

If we fire a 'load' event, the frame looks just like any other
cross-origin load that succeeded. If we don't fire a 'load' event,
timing attacks can gain knowledge about the URL in the frame by blocking
the URL in a page's CSP, and waiting long enough to be sure that a 'load'
event _would_ have fired if the load wasn't blocked.

R=japhet@chromium.org, jochen@chromium.org

This is a re-land of https://src.chromium.org/viewvc/blink?view=rev&revision=165587
which was reverted due to a browser_test failure. Carrying over japhet's
LGTM from https://codereview.chromium.org/143323012, TBRing the reverter.

TBR=eustas@chromium.org

Review URL: https://codereview.chromium.org/145083011

git-svn-id: svn://svn.chromium.org/blink/trunk@165743 bbb929c8-8fbe-4397-9dbb-9b2b20218538