Extract CSPSource from ContentSecurityPolicy.

We'll likely need to move pieces of CSP up to content/ in order to
support things like exposing the referrer policy directly to the network
stack (for redirects, etc). That's not going to be possible to evaluate
until CSP's various components are split out of the single monolithic
file.

BUG=346642

Review URL: https://codereview.chromium.org/179533002

git-svn-id: svn://svn.chromium.org/blink/trunk@167785 bbb929c8-8fbe-4397-9dbb-9b2b20218538