Make HTMLViewSourceParser also run the XSSAuditor when it is creating a view source
page, and mark the tokens that it thinks are reflected XSS vectors using a
red highlight.

This happens to work at the moment in both "rewrite" and "block" xss protection
modes, because we don't use the modified token when constructing the view
source page.  Ideally, the logic about what mode to use should move out of
XSSAuditor, so that view-source can pass in a value suitable for this specific
case.

Tangentially related to the "XSS Auditor is silent" bug.
BUG=93976

Review URL: https://codereview.chromium.org/301813002

git-svn-id: svn://svn.chromium.org/blink/trunk@175320 bbb929c8-8fbe-4397-9dbb-9b2b20218538