In particular calling AddPolicyFromHeaderValue is not something that is safe to do from multiple threads, even if different ContentSecurityPolicy instances are used, because:
- it uses blink::CSPDirectiveList to parse the header
- blink::CSPDirectiveList uses blink::SpaceSplitString to parse the string
- blink::SpaceSplitString uses a DEFINE_STATIC_LOCAL singleton DataMap (to cache things I think?) with no consideration for multiple threads