SECURITY: Disallow -o-link in styles

Opera will execute javascript from -o-link css attributes.

Bug: 58472
Change-Id: I3b640282ca1feeb175b095e9fdc4dc3ceff05e0f
SECURITY: Return error on invalid XML for SVGs

Return an error from UploadBase::detectScriptInSvg when the svg has
XML that cannot be parsed. Usually the XML is invalid, or the parser has
run out of memory trying to parse the file.

This patch is rebased on top of bug 57550.

Bug: 58553
Change-Id: I32661a27d7417cc2c69b844c805b190d6486d17a