Move CSP monkey patches into HTML.

[mikewest]

https://w3c.github.io/webappsec-csp/#html-integration lists a number of patches that need to be made to HTML in order to support CSP. I'll wrap those up here.

[domenic]

@mikewest anything left to do here?

[Ms2ger]

Seems like there's patches to setTimeout/setInterval that haven't made their way into the spec, at least.

[domenic]

Here's how I'd ideally like that to shake out:

• Layering: add hook to allow implementations to block string compilation tc39/ecma262#451 lands
• CSP3 defines HostEnsureCanCompileStrings for the web platform
• HTML delegates to HostEnsureCanCompileStrings, with the xref going to CSP3's definition (instead of ES's)

@mikewest how does that plan sound?

[domenic]

tc39/ecma262#451 was merged so if @mikewest wants to proceed by defining HostEnsureCanCompileStrings in CSP3, that'd be swell. If you'd rather I do it with a PR, let me know and I can get around to it.

[mikewest]

Just saw this, sorry about the delayed response. I'll add that definition to CSP3 shortly.

[domenic]

I realize that this probably isn't entirely fixed by 374b54d as the link in the OP lists a few items without red "this is fixed in WHATWG HTML" boxes. So I'll reopen until @mikewest proclaims mission accomplished.