allow secure variant of scheme when only insecure is given

[michaelficarra]

See recent spec change here: w3c/webappsec-csp#25 (comment)

[shekyan]

Actually, this is going to be CSP3 feature. We have an option to either branch, or have the same code base for all versions with upper version specifier..

[michaelficarra]

I think we should just track the most recent version, as is done with most tooling for web features.

[shekyan]

Then we also need to support directives that exist in most recent version.

[shekyan]

6.1.10.3, 3, 2: If expression does not have a scheme-part ... changes the assumption that missing scheme in source-expression is http.
there are more changes from level 2.
We definitely need to discuss how to combine level 3 with what we already have.

[shekyan]

example:

Policy p = Parser.parse("script-src a;", "http://example.com");
p.allowsScriptFromSource(Uri.parse("https://a")); // should be true, currently false