[webappsec] moving frame-ancestors directive into mainline CSP 1.1

I've resisted this idea in the past, but now I think it is a good idea to
move the frame-ancestors directive out of the UISecurity spec and into the
mainline CSP 1.1 spec.

 With my hat on as an editor, I'd like to make this change immediately.  If
you have objections, please bring them to tomorrow's call (with chair hat,
I'll make agenda time) or raise them on the list.

 Thank you,


Brad Hill