This is a case of included content that we had neglected to filter. 

The complexity of the CL is in granting an exemption to same-origin content, which implies applying the same tests to an href attribute that formerly only applied to src attributes.  But we don't want to give a pass to all href attributes irrespective of tag, so we need more flags.

BUG=421166

Review URL: https://codereview.chromium.org/644663003

git-svn-id: svn://svn.chromium.org/blink/trunk@183552 bbb929c8-8fbe-4397-9dbb-9b2b20218538