SecurityPolicyViolation DOM events.

In https://dvcs.w3.org/hg/content-security-policy/rev/0c7cb63e2e48, I've
stubbed out an initial pass at a SecurityPolicyViolationEvent interface.
I'd appreciate some feedback on both the content and the language used to
describe it. I tried to steal context from other specs, but none really did
exactly what I wanted. Ah well.

In a nutshell, the intent is to fire 'securitypolicyviolation' events at
the protected resource's Document. Each event contains the same properties
as the current report object, which seems like a reasonable first step.
Once we go around a bit on the core, I'm thinking about three additions:

1. Policies should be able to opt-out of DOM-level reporting, as discussed
in
a November 2012 thread[1].

2. Violation events should possibly include a DOM reference (perhaps as a
'relatedTarget'?) to the node that triggered the error (see the same
thread[1] for context).

3. A running list of violation events should potentially be stored
('document.securityPolicyViolations'?) so that violations that occur before
a developer hooks up an event handler can still be dealt with in some
fashion.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2012Nov/0128.html

Feedback is much appreciated.

--
Mike West <mkwst@google.com>, Developer Advocate
Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany
Google+: https://mkw.st/+, Twitter: @mikewest, Cell: +49 162 10 255 91