CSP: Pull duplicate attribute hardening back out.

I expected this to be a no-op, but broke Docs. C'est la vie.
Manually verified that Docs isn't broken after this patch.

Bug: 790955
Change-Id: Id8290a5c1f826d1f374e6531de8e8433a814b21c
Reviewed-on: https://chromium-review.googlesource.com/803478
Commit-Queue: Mike West <mkwst@chromium.org>
Reviewed-by: Andy Paicu <andypaicu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#520944}

third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/nonce-enforce-blocked-expected.txt

+This is a testharness.js-based test.
+FAIL Unnonced scripts generate reports. assert_unreached: Duplicate attribute, no execution. Reached unreachable code
+Harness: the test ran to completion.
+

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

@@ -104,14 +104,13 @@ bool ContentSecurityPolicy::IsNonceableElement(const Element* element) {
   // To prevent an attacker from hijacking an existing nonce via a dangling
   // markup injection, we walk through the attributes of each nonced script
   // element: if their names or values contain "<script" or "<style", we won't
-  // apply the nonce when loading script. We'll also skip elements for which
-  // the HTML parser dropped attributes.
+  // apply the nonce when loading script.
+  //
+  // TODO(mkwst): We'll should also skip elements for which the HTML parser
+  // dropped attributes: https://crbug.com/740615 and https://crbug.com/790955.
   //
   // See http://blog.innerht.ml/csp-2015/#danglingmarkupinjection for an example
   // of the kind of attack this is aimed at mitigating.
-  if (element->HasDuplicateAttribute())
-    nonceable = false;
-
   if (nonceable) {
     static const char kScriptString[] = "<SCRIPT";
     static const char kStyleString[] = "<STYLE";