Don't crash the browser if something tries to inject JavaScript

Don't crash the browser if something tries to inject JavaScript

Instead, just trigger a report for users that have opted in, and
DCHECK() for developers.

We still don't execute the script..

Developers that hit this DCHECK should either fix their code if they didn't
intend to inject into a random page, consider using one of our many C++ APIs,
or inject into an isolated world.

There is a separate API for tests that can run on any page. For tests only.

BUG=516690
R=creis@chromium.org

[Charlie Reis, 2015-08-04 19:59:56]

Yes, this should get us the same reports without crashing the user's browser
(and without leaking info into web renderers).  That said, I'm not sure we want
to downgrade this to a DCHECK.

My main concern here is that any code failing this DCHECK has a fairly good
chance of trying to do other privileged things in the WebContents before the
WebUI page commits (given that it already tried to do one dangerous thing). 
Allowing the code to proceed (even without the injected JS) risks other security
issues until the offending code is fixed.  Keeping it as a CHECK could make it a
higher priority thing to fix and prevent privilege escalation in the meantime.

It seems like we'd be in a better spot if we fixed the occurrences of these
crashes and kept the CHECK.

[jochen (gone - plz use gerrit), 2015-08-04 20:03:42]

sgtm