Introduce `DirectiveSetBuilderInterface` to allow runtime modification

[martijnc]

This PR introduces the DirectiveSetBuilderInterface and the default implementationConfigurationDirectiveSetBuilder proposed in #347, to allow for runtime modification of the CSP directive sets. The major changes are:

• Introduction of DirectiveSetBuilderInterface and ConfigurationDirectiveSetBuilder;
• The ContentSecurityPolicyListener constructor now takes DirectiveSetBuilderInterface instead of the directive sets directly;
• Changes to NelmioSecurityExtension to provide the configuration to the ConfigurationDirectiveSetBuilders, which in turn are injected into ContentSecurityPolicyListener (instead of the directive sets).

This adds a layer between the configuration (and the directive sets built from it) and ContentSecurityPolicyListener. This layer provides an integration point for application code to modify the directive sets based on the request (e.g., in a controller or a kernel event listener).

[Seldaek]

Sorry but I won't manage to review this one right now, seems solid at first sight but I'd rather give it some more thought.