API: Work around wfMangleFlashPolicy()

The things wfMangleFlashPolicy() does to the output break things in the
API. For JSON we can work around it, while for PHP we just have to error
out. XML isn't affected because <> are escaped anyway (unless something
somehow uses 'cross-domain-policy' as a tag name), and the rest are
going away soon so they're not worth the trouble.

Backport, originally committed by Brad Jorsch

Bug: 66776
Change-Id: Idc5f37bd778288a9cde572f081dc753d681ec354
Merge "API: Work around wfMangleFlashPolicy()" into REL1_23