safe_browsing::PhishingClassifierDelegates to return a reference

A previous patch inadvertantly changed the code to return the set of
PhishingClassifierDelegates by value.  This lead to a crash because
all modifications to the set where only applied to the local copy,
and when PhishingClassifierDelegate::SetPhishingScorer got called,
pending classifications (which stashed a raw pointer to the deleted
data) where not cancelled.

Bug: 905598
Change-Id: Id629c460b1fba66605565b8f17b6bd1d1fc6cf33
Reviewed-on: https://chromium-review.googlesource.com/c/1341520
Commit-Queue: Varun Khaneja <vakh@chromium.org>
Reviewed-by: Varun Khaneja <vakh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#609387}

chrome/renderer/safe_browsing/phishing_classifier_delegate.cc

@@ -39,7 +39,7 @@ GURL StripRef(const GURL& url) {
   return url.ReplaceComponents(replacements);
 }
 
-std::set<PhishingClassifierDelegate*> PhishingClassifierDelegates() {
+std::set<PhishingClassifierDelegate*>& PhishingClassifierDelegates() {
   static base::NoDestructor<std::set<PhishingClassifierDelegate*>> s;
   return *s;
 }