Create script-src from script-src-attr and script-src-elem

I see I may have not been clear in my descriptions - neither -elem or -attr would be removed from the policy. The base directive would be determined from the more specific directives' values, but all three directives would be included in the header.

The intent is to reduce the likely hood of someone incorrectly configuring the base directive themself in a way that would result in different behaviour between browsers that did or did not support the more specific directives.