GitLab

This CL disallows an unlocked renderer process from accessing
origins/urls that require isolation (i.e. require a process lock).

The new enforcement works only on the UI thread - calls to
CanAccessDataForOrigin on the IO thread will unfortunately continue to
allow access for all unlocked renderer processes.  See also
https://docs.google.com/document/d/17t85azUYz-Wzo9vPrrghd47ilxjqCryDNJPGROKc8Es

The new enforcement is enabled only on Android.  On desktop, the
citadel-style enforcement is blocked by NTP support for OOPIFs - see
https://crbug.com/566091 and also
https://docs.google.com/document/d/1jtanAByotYMaJzdxd2aIknwoVz1kjxL_HAR_mKBsJls

Bug: 764958
Change-Id: I7864ca737c14c26c3c8cefe3cc2887028f891679
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1545157Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Bo <boliu@chromium.org>
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Cr-Commit-Position: refs/heads/master@{#699436}