[webappsec] more CSP test review begging

https://critic.hoppipolla.co.uk/r/5772

I went through the full test suite and debugged all the Firefox failure
cases, made a number of fixes, and I believe that all failures by both
Chrome and Firefox are now legitimate spec compliance issues.  Would love
some review to merge this - next step is to inventory test coverage vs. the
feature set of CSP2 so we can go to REC when we have two implementations of
all features.

thanks!

-Brad