Partial XSS auditor bypass when server collapses path components.

We can't trust the number of slashes when looking for a match, so remove
them when we canonicalize the string.

Unfortunately, we absolutely need to have the slashes when looking for
terminating conditions.  So split out the canonicalization from the decoding,
so that we can decode first, then look for termination, then canonicalize.

BUG=344146
R=abarth@chromium.org

Review URL: https://codereview.chromium.org/174373003

git-svn-id: svn://svn.chromium.org/blink/trunk@167610 bbb929c8-8fbe-4397-9dbb-9b2b20218538