[doc] add public docs about Webview Policies

docs/webview_policies.md

+# WebView Policies
+
+## Overview
+
+WebView supports a subset of Chrome's policies, that can be set via the
+[App Restrictions][1] mechanism. They are read on the embedder app itself rather
+than from a centralized location. That gives administrator more flexibility and
+granularity, but to apply a global policy, it has to be set separately
+on each app.
+
+The policies will be applied to WebViews used inside the targeted apps without
+having to modify the apps themselves. No special WebView APIs have been added
+to expose policy information. If developers want to change their app's behavior
+depending on that, they can [read them][2] as they have access to the
+App Restrictions.
+
+## Supported policies

[Bernhard Bauer, 2016/04/07 15:55:55]

I wouldn't actually add this, as it will just become stale if we add more
policies. The policy list at [2] will always show the correct state

[dgn, 2016/04/08 12:29:27]

Done.

+
+*   Simple URL filtering
+    +   `com.android.browser:URLBlacklist`: Block access to a list of URLs
+    +   `com.android.browser:URLWhitelist`: Allows access to a list of URLs, as
+        exceptions to the URL blacklist
+
+*   Kerberos Setup
+    +   `com.android.browser:AuthServerWhitelist`: Specifies which servers
+        should be whitelisted for integrated authentication
+    +   `com.android.browser:AuthAndroidNegotiateAccountType`: Specifies the
+        account type of the accounts provided by the Android authentication app
+        that supports HTTP Negotiate authentication
+
+Please see the full [Policy List][2] for more information.
+
+[3]: http://developer.android.com/training/enterprise/work-policy-ctrl.html#apply_restrictions
+[1]: http://developer.android.com/training/enterprise/app-restrictions.html
+[2]: https://www.chromium.org/administrators/policy-list-3