CSP: Move 'worker-src' onto 'script-src'

Based on the discussion in w3c/webappsec-csp#146,
we're deprecating 'child-src' and moving 'worker-src' onto 'script-src'.

Intent to Ship: https://groups.google.com/a/chromium.org/d/msg/blink-dev/npKDoKVOUAs/ogtlIFmLBAAJ

BUG=662930,694525

Review-Url: https://codereview.chromium.org/2533313002
Cr-Commit-Position: refs/heads/master@{#458026}

content-security-policy/worker-src/service-child.https.sub.html

@@ -2,7 +2,7 @@
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="../support/testharness-helper.js"></script>
-<meta http-equiv="Content-Security-Policy" content="child-src http://{{host}}:{{ports[http][0]}}">
+<meta http-equiv="Content-Security-Policy" content="child-src https://{{host}}:{{ports[https][0]}}">
 <script>
   var url = new URL("../support/ping.js", document.baseURI).toString();
   assert_service_worker_is_loaded(url, "Same-origin service worker allowed by host-source expression.");

content-security-policy/worker-src/service-fallback.https.sub.html

@@ -2,7 +2,7 @@
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="../support/testharness-helper.js"></script>
-<meta http-equiv="Content-Security-Policy" content="worker-src http://{{host}}:{{ports[http][0]}}; child-src 'none'">
+<meta http-equiv="Content-Security-Policy" content="worker-src https://{{host}}:{{ports[https][0]}}; child-src 'none'">
 <script>
   var url = new URL("../support/ping.js", document.baseURI).toString();
   assert_service_worker_is_loaded(url, "Same-origin service worker allowed by host-source expression.");

content-security-policy/worker-src/service-list.https.sub.html

@@ -2,7 +2,7 @@
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="../support/testharness-helper.js"></script>
-<meta http-equiv="Content-Security-Policy" content="worker-src http://{{host}}:{{ports[http][0]}}">
+<meta http-equiv="Content-Security-Policy" content="worker-src https://{{host}}:{{ports[https][0]}}">
 <script>
   var url = new URL("../support/ping.js", document.baseURI).toString();
   assert_service_worker_is_loaded(url, "Same-origin service worker allowed by host-source expression.");