Adding CSP to Speech Input API sample.

Adding `content_security_policy` to Speech Input API sample.

As a drive-by, this CL also regenerates the `experimental.settings` docs, which someone apparently forgot to do after committing. :)

BUG=92644
TEST=

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=111588

[Mike West, 2011-11-25 10:09:43]

Hi Lenadro!

This CL adds a content security policy to the Speech Input API sample, locking
it down to only executing JavaScript from within it's own package. We're really
trying to encourage developers to use CSP for all their extensions, so I want to
make sure we're setting a good example. :)

Thanks!

-Mike

[Leandro Graciá Gil, 2011-11-25 11:06:23]

Hi,

If you have tested this to work (you can say something and it gets recognized,
and start/stop by clicking) then it LGTM. Thanks for this!

On 2011/11/25 10:09:43, Mike West (chromium) wrote:
> Hi Lenadro!
> 
> This CL adds a content security policy to the Speech Input API sample, locking
> it down to only executing JavaScript from within it's own package. We're
really
> trying to encourage developers to use CSP for all their extensions, so I want
to
> make sure we're setting a good example. :)
> 
> Thanks!
> 
> -Mike

[Mike West, 2011-11-25 11:13:51]

On 2011/11/25 11:06:23, Leandro Graciá Gil wrote:
> Hi,
> 
> If you have tested this to work (you can say something and it gets recognized,
> and start/stop by clicking) then it LGTM. Thanks for this!

Cool. Rebuilding docs, and I'll land this manually in a moment (can't use the
queue until it handles zip files correctly...).

Thanks!

-Mike

[Aaron Boodman, 2011-11-27 06:20:43]

Hi Mike,

I mentioned this to Boris on another thread, but I guess word did not make it to
you. I don't think we should do this.

We don't want developers to copy this magic incantation into their manifests.
The extension system should just do the right thing by itself.

Instead, we want developers to put manifest_version:2 in their manifests. That
won't work yet, but when it does, it will default CSP to the right thing.

[Mike West, 2011-11-27 07:00:10]

On 2011/11/27 06:20:43, Aaron Boodman wrote:
> I mentioned this to Boris on another thread, but I guess word did not make it
to
> you. I don't think we should do this.

Ok, I hadn't heard that.

I'll follow up with you on a new thread, thanks.

-Mike