[WebView] Disallow geolocation on insecure origins for apps targeting N and higher.

android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java

Index: android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java
diff --git a/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java b/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java
index 8f25c5d1535f61357278b57559e27445476b518e..4769a4e01185c8b7c2e9b1fec508418cc5a5d8ec 100644
--- a/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java
+++ b/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java
@@ -235,12 +235,15 @@ class WebViewChromium implements WebViewProvider, WebViewProvider.ScrollDelegate
                 mAppTargetSdkVersion < Build.VERSION_CODES.JELLY_BEAN;
         final boolean areLegacyQuirksEnabled = mAppTargetSdkVersion < Build.VERSION_CODES.KITKAT;
         final boolean allowEmptyDocumentPersistence = mAppTargetSdkVersion <= Build.VERSION_CODES.M;
+        final boolean allowGeolocationOnInsecureOrigins =
+                mAppTargetSdkVersion <= Build.VERSION_CODES.M;
 
         mContentsClientAdapter =
                 new WebViewContentsClientAdapter(mWebView, mContext, mFactory.getWebViewDelegate());
         mWebSettings = new ContentSettingsAdapter(
                 new AwSettings(mContext, isAccessFromFileURLsGrantedByDefault,
-                        areLegacyQuirksEnabled, allowEmptyDocumentPersistence));
+                        areLegacyQuirksEnabled, allowEmptyDocumentPersistence,
+                        allowGeolocationOnInsecureOrigins));
 
         if (mAppTargetSdkVersion < Build.VERSION_CODES.LOLLIPOP) {
             // Prior to Lollipop we always allowed third party cookies and mixed content.