Block mixed <picture> and <img srcset> by default.

It's going to be more or less impossible to begin blocking mixed <img>
content by default, given the amount of usage we're likely to see in the
wild (I'm still waiting for metrics from Chrome stable, but I'm not
hopeful). I think it will be significantly less impossible to avoid the
same mistake with the new responsive hotness.

This CL treats <picture> and <img srcset> as active content, blocking
them by default when mixed.

BUG=390158

Review URL: https://codereview.chromium.org/356243003

git-svn-id: svn://svn.chromium.org/blink/trunk@177385 bbb929c8-8fbe-4397-9dbb-9b2b20218538