Add something like `'secure-contexts'` to `frame-ancestors`'s source list.

[mikewest]

@rlbmoz proposed something like this in https://lists.w3.org/Archives/Public/public-webappsec/2015Oct/0070.html, and @annevk seems in favor. So, maybe it's worth doing.

[mikewest]

If someone else feels strongly about adding it to CSP3, I'd be happy to review a patch; otherwise let's revisit in the future.

[annevk]

It seems like a somewhat important feature. We provide all kinds of controls for those embedding, but not a lot of control for those being embedded. Being able to trust the place you're embedded in seems fairly basic in an HTTPS world.

[mikewest]

Sure. I'm just wondering if there are use cases for something more granular than frame-ancestors https:.

[annevk]

I guess not, though how did we address the auxiliary browsing context question? Are those always a secure context if delivered over HTTPS?

[mikewest]

They are not always secure contexts, but I'm wondering whether that narrow distinction is worth adding complexity to the processing model. shrug Not a huge deal either way, of course,but CSP's already pretty large...

[annevk]

It's probably not worth addressing through frame-ancestors.