introduce DirectiveSet class

This commit changes the constructor of ContentSecurityPolicyListener
but I don't consider this to be a public API. The public API is just
the configuration.
add config def for report|enforce subtrees

but use the full directive names
e.g. img-src instead only img, report-uri instead report_uri
handle new configuration with report, enforce sub trees