CSP3: DOM API Strawman

I've started putting together a strawman DOM API for discussion:
https://w3c.github.io/webappsec/specs/content-security-policy/#strawman-dom-api

The current mishmash of IDL should (I think) support everything necessary
for source list directives like `script-src`. It'll need more work to
support things like `sandbox`, `referrer`, etc. There's not enough
explanation, but the general outline of a policy declaration could look
something like:

    // Assuming a Service Worker:
    self.addEventListener('fetch', function(event) {
      var p = new SecurityPolicy("script-src https://example.com");
      if (!p.allowRequest(event.request))
        event.respondWith(Response.error());
      ...
    });

I know there's not a lot of detail there, but perhaps it's enough to kick
off a conversation? CCing folks that I know are interested. :)

--
Mike West <mkwst@google.com>
Google+: https://mkw.st/+, Twitter: @mikewest, Cell: +49 162 10 255 91

Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
Geschäftsführer: Graham Law, Christine Elizabeth Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)