SECURITY: Disallow non-whitelisted namespaces

Disallow uploading non-whitelisted namespaces. Also disallow iframe
elements.

User will get an error including the namespace name if they use a non-
whitelisted namespace.

Bug: 60771
Change-Id: Id5c022543184b19b77ad32d9a8a0c2dbbc5e9038
Merge "SECURITY: Disallow non-whitelisted namespaces" into REL1_22