Weaken MixedContentChecker's frame evaluation.

For the moment, treat non-CORS-enabled schemes as passive content in
order to allow things like "ssh" URL schemes to launch from an iframe.

This isn't a good long-term solution: http://crbug.com/393481 will
solve the underlying issue, at which point we can revert this change.

BUG=318788

Review URL: https://codereview.chromium.org/393493003

git-svn-id: svn://svn.chromium.org/blink/trunk@178148 bbb929c8-8fbe-4397-9dbb-9b2b20218538