commit 82f74b025438d88016d67f1d27b7ffca1d149dac
author amalika <amalika@google.com> Mon Dec 05 12:52:07 2016
committer Commit bot <commit-bot@chromium.org> Mon Dec 05 12:54:20 2016
tree 950c386009bc5a30fb8c465a7a9610221e048127
parent d66f0fed724f3eff65201ae8e132713ea3b4b726

Part 3.5: Is policy list subsumed under subsuming policy?

This is part of an experimental feature Embedding-CSP.

Here we add support for `none` source lists. Note that
normalized returned CSP might not explicitly declare `none`, but
with contradictory sources can allow effectively `none`.

For example if the secure origin is `http://google.com`:
Content-Security-Policy: script-src 'self'
Content-Security-Policy: script-src https://example.test/

then it should be subsumed by the Embedding-CSP that is :
Content-Security-Policy: script-src 'none'

BUG=647588

Review-Url: https://codereview.chromium.org/2528423002
Cr-Commit-Position: refs/heads/master@{#436270}