Allow https: loads for http: restrictions

[ckerschb]

Similar to what applies to schemeless resources where CSP allows https: loads, the spec should be changed to also allow https: loads to succeed if the CSP src is defined as http:

In easier words, taken a CSP:

img-src http:
the CSP should allow loading https: images.

[mikewest]

I've thought about this a bit this morning after chatting with @TanviHacks and @rlbmoz, and I think it makes sense to always allow upgrades from insecure resources to secure resources at the same host and path. That is, if we do this for http:, we might as well do it for http://example.com and 'self' as well. I'll take a stab at this and #7 together, as they end up touching the same pieces.

[mikewest]

Poked at this in 0e81d81. WDYT?