Add more security attributes to the manifest.

I think we need the Caller-Allowable-Codebase attribute so that javascript
bridges work. I also added a Application-Library-Allowable-Codebase.

The full list of security attributes and their meanings:
http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/manifest.html

lib/manifest.mf

@@ -1,4 +1,6 @@
 Main-Class: com.threerings.getdown.launcher.Getdown
 Permissions: all-permissions
-Codebase: *
 Application-Name: Getdown
+Codebase: *
+Application-Library-Allowable-Codebase: *
+Caller-Allowable-Codebase: *