GitLab

Respect FrameSrc directive in WebUI, otherwise WebUIs use wider
ChildSrc CSP to be able to embed iframes.

In many places we are using 'frame-src' CSP with ChildSrc directive
which is wrong. We have to either use 'frame-src' with FrameSrc or
'child-src' with ChildSrc. Mostly we just need to be able to embed
iframe and do not need web workers, so 'frame-src' will be enough.

Bug: 1105408
Change-Id: I6d7bd555f6411971db24fdfe9e3f299bf83a8a0e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2302990Reviewed-by: Trent Apted <tapted@chromium.org>
Reviewed-by: dpapad <dpapad@chromium.org>
Reviewed-by: Giovanni Ortuño Urquidi <ortuno@chromium.org>
Commit-Queue: Oleh Lamzin <lamzin@google.com>
Cr-Commit-Position: refs/heads/master@{#789399}