GitLab

This CL uses the "Subsume" algorithm for Content-Security-Policy
Embedded Enforcement https://w3c.github.io/webappsec-cspee implemented
n the services/network CSP module from the AncestorThrottle for
checking whether a frame should be allowed to embed or not. The same
behaviour is currently enforced by blink. The new version is hidden
behind a feature flag.

Change-Id: I4f72782a209bda967843e290d180167151fca852
Bug: 1094909,1086857
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2270206
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#804240}