CSP: Change 'self' to ask the policy object whether a URL matches.

Currently, when CSPSourceList encounters "'self'" in a source list, it
creates a CSPSource using the currently available SecurityOrigin. If
we want to be able to create CSP objects before documents are available
(to support `frame-ancestors` for instance), we need to break this
dependency.

This patch adjusts CSPSourceList to ask the policy object whether a URL
matches self, and the policy object to store a replacable CSPSource
object that could be swapped out if the SecurityOrigin changes.

BUG=411889

Review URL: https://codereview.chromium.org/549163003

git-svn-id: svn://svn.chromium.org/blink/trunk@181629 bbb929c8-8fbe-4397-9dbb-9b2b20218538