GitLab

The Content Security Policy specification[1] notes that "Enforcing a CSP
policy should not interfere with the operation of user-supplied scripts
such as third-party user-agent add-ons and JavaScript bookmarklets."
To that end, this CL allows `chrome-extension` resources to bypass
their containing document's policy, meaning that (for example)
`chrome-extension://[ID]/image.png` can be injected into a page, even
if that page has an `img-src 'none';` CSP directive.

[1]: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#processing-model

BUG=133223
TBR=thakis@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10792008

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@149627 0039d316-1c4b-4281-b951-d872f2087c98