Let ContentSecurityPolicy shared between imports and the master.

This change is to match Blink's HTML Imports implementation
match the spec change [1] which says that all imported document
should follow CSP of the master document, instead of its own.

The implementation is straightforward. It:

- Makes ContentSecurityPolicy object ref-counted and passes
  one of the master to its imported document.
- Disables <meta> directive for CSP when the document is an import.

Tests have to be changed much. As one CSP constraints all the scripts in each test,
things like shouldBe() is no longer usable in many test. Also, many imports
are now need to be servced via CORS so the change turns some of them from HTML to CGI.

Removed tests are ones that is no longer relevant: if script-src is unsafe-inline,
we cannot load any imports thus cannot test scripts in such imports.

[1] https://www.w3.org/Bugs/Public/show_bug.cgi?id=24268

BUG=334210
TEST=http/tests/htmlimports/
R=abarth@chromium.org, dglazkov@chromium.org

Review URL: https://codereview.chromium.org/183883004

git-svn-id: svn://svn.chromium.org/blink/trunk@168331 bbb929c8-8fbe-4397-9dbb-9b2b20218538