Block insecure XHR on secure pages.

This patch changes XHR from "passive" to "active" content; mixed XHR
will be blocked, just like mixed WebSockets, mixed script, mixed CSS,
and so on.

BUG=239540

Review URL: https://codereview.chromium.org/356473003

git-svn-id: svn://svn.chromium.org/blink/trunk@176870 bbb929c8-8fbe-4397-9dbb-9b2b20218538