Mixed Content: Implement strict mode.

Mixed Content: Implement strict mode.

https://w3c.github.io/webappsec/specs/mixedcontent/#strict-mode defines
strict mixed content checking, which allows authors to opt-into stricter
mixed content checking with the following effects:

1.  "Optionally-blockable" mixed content will be treated as "blockable"
    mixed content, meaning that mixed content of all types will be blocked
    by default.

2.  Embedder notification is suppressed, meaning that users will not be
    offered the ability to choose to enable mixed content for a particular
    document, even if they really really want to (similar to HSTS's effect
    on TLS violations).

Together, this has the effect of allowing a site to avoid degraded security
UI, which removes some of the risk of migrating to HTTPS.

This patch lands the 'strict-mixed-content-checking' CSP directive behind
the experimental flag, as I suspect we'll bikeshed the name a bit before
shipping the spec.

BUG=442662
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=187241

[Mike West, 2014-12-16 09:38:20]

mkwst@chromium.org changed reviewers:
+ jochen@chromium.org, rsleevi@chromium.org

[Mike West, 2014-12-16 09:38:46]

mkwst@chromium.org changed reviewers:
+ palmer@chromium.org

[Mike West, 2014-12-16 09:38:46]

Jochen, mind taking a look?

Ryan, Chris: FYI.

[jochen (gone - plz use gerrit), 2014-12-16 09:45:58]

lgtm

[Mike West, 2014-12-16 10:03:31]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2014-12-16 10:04:23]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/811773002/40001

[commit-bot: I haz the power, 2014-12-16 10:56:40]

Committed patchset #3 (id:40001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=187241