Change csp api to handle more directives

[jasisk]

This change is long overdue and has had a couple attempts by others (sorry, folks!).

Implemented a more flexible, yet backwards-compatible csp api. Csp policies are more fluid than our current api supports with things like argument-less directives (e.g., block-all-mixed-content).

New api supports string policies for maximum flexibility, array policies (just fancy string concatenation), and the old object policy api.

Big thanks to @turboMaCk and @giladgo for their PRs ages ago. I've thrown commits from you two into this PR to ensure they're at least captured in the repo.

Closes #69, #71, #72.

edit does introduce a behavior change but only the case of a failed policy. Previously would either result in a context-less throw or fail silently. Now, an unhanded policy type throws explicitly.

[turboMaCk]

100% agree that this is better solution! Nice work :+1:

[giladgo]

Nice work :+1: tbh, I'm a bit confused, does this code allow writing things like

"policy": {
  "default-src": ["'self'", "https://*.google-analytics.com", "https://*.bla.com"]
}

? If yes, can we add a test case for this?

[jasisk]

If yes, can we add a test case for this?

It does not. The equivalent would be:

{
  "policy": "default-src 'self' https://*.google-analytics.com https://*.bla.com"
}

// or, as is already supported:
{
  "policy": {
    "default-src": "'self' https://*.google-analytics.com https://*.bla.com"
  }
}

... or, if one of many directives:

{
  "policy": [
    "default-src 'self' https://*.google-analytics.com https://*.bla.com",
    "image-src *"
  ]
}

// or
{
  "policy": [
    {
      "default-src":  "'self' https://*.google-analytics.com https://*.bla.com"
    },
    "image-src *"
  ]
}