Add an error page for resources blocked via XSS Auditor.

components/error_page_strings.grdp

 <?xml version="1.0" encoding="utf-8"?>
 <grit-part>
 
   <message name="IDS_ERRORPAGE_NET_BUTTON_DETAILS" desc="Label for the button that expands the details on a net error page">
     Details
   </message>
   <message name="IDS_ERRORPAGE_NET_BUTTON_HIDE_DETAILS" desc="Label for the button that hides the details on a net error page">
     Hide details
   </message>
   <message name="IDS_ERRORPAGES_BUTTON_MORE" desc="Label for the button that expands the details on an error page">
@@ skipping 242 matching lines @@
   </message>
   <message name="IDS_ERRORPAGES_HEADING_INSECURE_CONNECTION" desc="Heading in the error page for insecure connections.">
     This site can’t provide a secure connection
   </message>
   <message name="IDS_ERRORPAGES_SUMMARY_BAD_SSL_CLIENT_AUTH_CERT" desc="Summary in the error page for SSL client certificate authentication failure.">
     <ph name="HOST_NAME">&lt;strong jscontent="hostName"&gt;&lt;/strong&gt;<ex>www.whatever.com</ex></ph> didn’t accept your login certificate, or one may not have been provided.
   </message>
   <message name="IDS_ERRORPAGES_SUMMARY_BLOCKED_BY_EXTENSION" desc="Summary in the error page when an extension blocks a request.">
     Requests to the server have been blocked by an extension.
   </message>
+  <message name="IDS_ERRORPAGES_SUMMARY_BLOCKED_BY_XSS_AUDITOR" desc="Summary in the error page when the XSS Auditor blocks a response.">

[Tom Sepez, 2016/10/28 16:45:59]

I don't think our users are likely to understand this, and will probably scare
them.  It doesn't provide an actionable next step. Let's see what enamel says.

[meacer, 2016/10/28 17:38:30]

(Not official Enamel™ stance) I tend to agree with Tom, and a console message
associated with a blank page sounds a tad better. It's also in line with other
security related headers (e.g. X-Frame-Options blocking the iframe and
displaying a blank page)

I'm worried that some clever attacker will trigger this and use it for social
engineering in the future. (Your Google is infected, click here to upgrade it!)

+    This page contains code which appears to be the result of a cross-site scripting attack, and is configured to block such requests.
+  </message>
   <message name="IDS_ERRORPAGES_SUMMARY_BLOCKED_BY_ADMINISTRATOR" desc="Summary in the error page when an administrator policy blocks a request.">
     The person who set up this computer has chosen to block this site.
   </message>
 
   <message name="IDS_ERRORPAGES_HTTP_POST_WARNING" desc="The error message displayed when the user navigates back or forward to a page which would resubmit post data. They can hit reload to send POST data again and load the page.">
     This webpage requires data that you entered earlier in order to be properly displayed. You can send this data again, but by doing so you will repeat any action this page previously performed.
   </message>
 
   <!-- Suggestions summary list messages. -->
   <message name="IDS_ERRORPAGES_SUGGESTION_LIST_HEADER" desc="Message that prefixes a list of suggestions to try when encountering a network error.">
@@ skipping 86 matching lines @@
   </if>
 
   <!-- iOS specific error page messages -->
   <if expr="is_ios">
     <message name="IDS_ERRORPAGES_SUMMARY_NOT_AVAILABLE_NO_EMPHASIS" desc="Summary in the error page when we can't connect to a site. [iOS only]">
       The webpage at <ph name="SITE">$1<ex>google.xom</ex></ph> might be temporarily down or it may have moved permanently to a new web address.
     </message>
   </if>
 
 </grit-part>