Block mixed <picture> and <img srcset> by default.

It's going to be more or less impossible to begin blocking mixed <img>
content by default, given the amount of usage we're likely to see in the
wild (I'm still waiting for metrics from Chrome stable, but I'm not
hopeful). I think it will be significantly less impossible to avoid the
same mistake with the new responsive hotness.

This CL treats <picture> and <img srcset> as active content, blocking
them by default when mixed.

------------------------------------------------------------------------
This is a re-land of r177385, which was reverted because it broke a few
browser_tests, Chromium-side. This patch differs from the initial
patch[1] only in that it now starts with a copy of
'ResourceFetcher::defaultResourceLoaderOptions()' rather than an empty
ResourceLoaderOptions.

[1]: https://codereview.chromium.org/356243003
------------------------------------------------------------------------

BUG=390158
TBR=yoav@yoav.ws

Review URL: https://codereview.chromium.org/368203002

git-svn-id: svn://svn.chromium.org/blink/trunk@177464 bbb929c8-8fbe-4397-9dbb-9b2b20218538