Add support for feature-policy header

Hello,

We hope a backport to Drupal 7. Pleaaaaase! ;)

First attempt to a 7.x port

re-roll of #2

Oh, hai Adam :)

This looks good for D8; committed. Thank you!

The D7 patch looks like it needs a bit more work though; at a glance:

1) It looks like it has a mix of array() and [] syntax, where D7 code should still use array().

2) These are defined (using the wrong array syntax) as empty values and never used.

+  $args = [
+    ':feature-policy_docs' => '',
+    '@feature-policy_docs' => "",
+  ];

3) This is wrong:

+    '#description' => t("Allows configuration of the Feature-Policy header to selectively enable, disable, and modify the behavior of certain APIs and web features in the browser. See !Feature_policy", array('!Feature_policy' => '<a href="https://developers.google.com/web/updates/2018/06/feature-policy">' . t("Google's developer documentation") . '</a>' . '.')),

Check one of the other #description elements for an example; we use something like this for the links:

$args = array(                                                                
  '!wiki' => l(t('Mozilla Wiki'), 'https://wiki.mozilla.org/Security/CSP'),

4) Copy-pasta; this is not "Origin-based protection".

+  // Defaults for variable_get('seckit_fp');
+  // Enable Origin-based protection.
+  $defaults['seckit_fp'] = array(

5) Tests please.

Here's another shot at the D7 version, with the edits suggested in #7.

I think the problem with the last patch was that the textfield for the actual policy has a maxlength of 128 by default, whereas the test is trying to set a policy of >140 chars.

It probably makes more sense to use a textarea, but that means I'd prefer the fieldset to be collapsed if the feature is disabled (as opposed to checking against the defaults).

It doesn't look like the admin form is consistent in which approach it takes for collapsing fieldsets, but that's a clean up job for another issue.

Thank you everyone that contributed!

Some debug slipped into the test in this issue, and has since been reformatted:

     $this->assertEqual($expected, $this->drupalGetHeader('Feature-Policy'), t('The feature-policy header is correctly sent.'));
-    debug(array('expected' => $expected, 'received' => $this->drupalGetHeader('Feature-Policy'), 'headers' => $this->drupalGetHeaders()));
+    debug(array(
+      'expected' => $expected,
+      'received' => $this->drupalGetHeader('Feature-Policy'),
+      'headers' => $this->drupalGetHeaders(),
+    ));
   }
+

I'm about to remove that.