new CSP draft.

Hello, webappsecians!

At TPAC, we discussed stripping CSP3 down to be a clearer explanation of
CSP2 in terms of Fetch, along with a set of hooks that enable modular
documents to define the new stuff. I'm slowly working towards that goal.

https://w3c.github.io/webappsec-csp/ is substantially rewritten, and I've
started working with our friends in the WHATWG to add relevant hooks to
their version of HTML and Fetch. There's still a little bit of outstanding
work to be done, but it's far enough along that it would be helpful to get
some more eyes on the document before I erroneously convince myself that
it's finished.

Once you finish reading Brad's new UI Security draft, I'd appreciate you
taking a look at this one. :)

-mike