Disallow arbitrary start URLs in the Manifest

Before this change Crosswalk allowed app launchig from arbitrary start URL's in the manifest.json ( config.xml for widgets). which is not allowed by both W3C manifest (http://w3c.github.io/manifest/#dfn-steps-for-processing-the-start_url-member) and widget (http://www.w3.org/TR/widgets/#the-src-attribute-0) specifications.

BUG=XWALK-2535