<webview>: Change how plugin load works inside guests.

The changes include:
 * Always disallow loading NPAPI plugins inside guests.
 * Do not allow installing a plugin from inside guests.
 * Mark all plugins inside guests as needing authorization. This triggers a
   javascript 'permissionrequest' event on the <webview> inside the embedder.
   The embedder can chose to allow() or deny() the plugin from being loaded. If
   the embedder callback doesn't preventDefault() the event, and does not call
   either allow() or deny(), then the plugin is allowed.

BUG=156120
R=bauerb@chromium.org, fsamuel@chromium.org, jam@chromium.org

Review URL: https://codereview.chromium.org/24576003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@225800 0039d316-1c4b-4281-b951-d872f2087c98
SVN changes up to revision 225800