CSP: &quotlocal schemes&quot should inherit policy when window.opened.

      https://w3c.github.io/webappsec-csp/#initialize-document-csp mandates
that resources with &quotlocal schemes&quot ('data:', 'blob:', 'filesystem:',
'about:') inherit the policy of their opening context when opened via
things like 'window.open'. We're not doing that, but we ought to.

BUG=669086
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2530343006
Cr-Commit-Position: refs/heads/master@{#435233}