New Extensions policy for Content Security Policy (CSP) directives and timeline for enforcement

Thanks, @Emef. Just to reiterate the commitment mentioned above: