Disable "HtmlImportsRequestInitiatorLock"

We see some breakage on M78, so we are disabling the feature. After
merging this change to M78 I will revert this change.

Bug: 1006292
Change-Id: Ie56d2ac5cdd6ed8ea0fdf8c124a3f01c24731eed
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1846832
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Reviewed-by: Matt Falkenhagen <falken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#703615}

content/browser/security_exploit_browsertest.cc

@@ -618,6 +618,9 @@ class CorsExploitBrowserTest : public ContentBrowserTest {
 // deprecated.
 IN_PROC_BROWSER_TEST_F(CorsExploitBrowserTest,
                        OriginHeaderSpoofViaHtmlImports) {
+  base::test::ScopedFeatureList feature_list;
+  feature_list.InitAndEnableFeature(
+      blink::features::kHtmlImportsRequestInitiatorLock);
   std::string victim_path = "/victim/secret.json";
   net::test_server::ControllableHttpResponse victim_response(
       embedded_test_server(), victim_path, false);

third_party/blink/common/features.cc

@@ -400,7 +400,7 @@ const base::Feature kLowerJavaScriptPriorityWhenForceDeferred{
     base::FEATURE_ENABLED_BY_DEFAULT};
 
 const base::Feature kHtmlImportsRequestInitiatorLock{
-    "HtmlImportsRequestInitiatorLock", base::FEATURE_ENABLED_BY_DEFAULT};
+    "HtmlImportsRequestInitiatorLock", base::FEATURE_DISABLED_BY_DEFAULT};
 
 }  // namespace features
 }  // namespace blink