Move hyperlink auditing ("ping") to the connect-src directive

This change brings the CSP spec in line with the relevant section
of the Fetch standard:

  https://fetch.spec.whatwg.org/#requests

This is implementing the change that was proposed by @dveditz in this thread:

  http://lists.w3.org/Archives/Public/public-webappsec/2014Nov/0259.html