Upgrade insecure requests: Pipe navigational hosts down into nested documents.

Source/core/frame/csp/ContentSecurityPolicy.cpp

Index: Source/core/frame/csp/ContentSecurityPolicy.cpp
diff --git a/Source/core/frame/csp/ContentSecurityPolicy.cpp b/Source/core/frame/csp/ContentSecurityPolicy.cpp
index acf852427b319190516be019a0bea00ca2a77e89..6d91ccea2c32b10dc74d4c71bbee99b460d0713f 100644
--- a/Source/core/frame/csp/ContentSecurityPolicy.cpp
+++ b/Source/core/frame/csp/ContentSecurityPolicy.cpp
@@ -176,8 +176,10 @@ void ContentSecurityPolicy::applyPolicySideEffectsToExecutionContext()
             document->enforceStrictMixedContentChecking();
         if (didSetReferrerPolicy())
             document->setReferrerPolicy(m_referrerPolicy);
-        if (m_insecureRequestsPolicy > document->insecureRequestsPolicy())
+        if (m_insecureRequestsPolicy > document->insecureRequestsPolicy()) {
             document->setInsecureRequestsPolicy(m_insecureRequestsPolicy);
+            document->addInsecureNavigationUpgrade(securityOrigin()->host().impl()->hash());
+        }
 
         for (const auto& consoleMessage : m_consoleMessages)
             m_executionContext->addConsoleMessage(consoleMessage);