CSP: 'sandbox' should be ignored in report-only mode.

This is the behavior Firefox is running with[1], and has recently been
explicitly clarified in the spec[2].

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=671389
[2]: https://github.com/w3c/webappsec/commit/2cc237a696e982be59886c8f2ba0ed2d84f22c81

BUG=335489

Review URL: https://codereview.chromium.org/133073007

git-svn-id: svn://svn.chromium.org/blink/trunk@165322 bbb929c8-8fbe-4397-9dbb-9b2b20218538