Remove the 'reflected-xss' directive from CSP.

This was removed from CSP2, never added to CSP3, and will not ship in
any other browser. We should remove it, as it is completely redundant
with `X-XSS-Protection`, which is never going away.

Intent to Remove: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/gjB93RpF6JY

R=jochen@chromium.org
BUG=657737

Review-Url: https://codereview.chromium.org/2428473004
Cr-Commit-Position: refs/heads/master@{#427040}
251 files changed