Mixed content: treat 'javascript:' form actions as secure.

We currently warn for insecure form actions on secure pages. A variety
of libraries use 'javascript:void(0)' as a form action when handling
the submission via JavaScript/XHR. We shouldn't treat that as a mixed
content violation.

This CL also exempts those folks who have enabled lax mixed content
checking from this newly-introduced check.

BUG=253249

Review URL: https://codereview.chromium.org/369793002

git-svn-id: svn://svn.chromium.org/blink/trunk@177505 bbb929c8-8fbe-4397-9dbb-9b2b20218538