Content-Security-Policy: add `child-src` directive to prevent deprecation warning
Content-Security-Policy: add `child-src` directive to prevent deprecation warning

According to the Content Security Policy Level 2 specitication, [`frame-src` is now deprecated](https://w3c.github.io/webappsec-csp/2/#directive-frame-src). To prevent warning, also declare `child-src` directive.

otetard/ownpad,otetard/ownpad