Introducing the CSP Fixer

@devoncarew

Devon: sorry, a couple of unrelated trivial changes have crept in.

I should also add tests.

Also note that I deliberately exposed the feature only in the form of an explicit action. I didn't want to build it into the Bower install/update sequence or anything like that because it's too early and too risky.

Not sure what the best workflow would be. Perhaps when the user first runs a chrome app, w/ non-vulcanized polymer components, we warn them?