<browser> Disable browser plugin in content_shell by default.

<browser> Disable browser plugin in content_shell by default.
This means I had to move the flag that forcefully enables browser plugin everywhere from chrome/ to content/.

Reasoning for the change:
Enabling browser plugin in regular pages (other than apps), breaks same origin policy: The embedder is allowed to inject javascript: URLs into the browser plugin, and it will soon be able to call executeScript.  That means the embedder can do whatever it wants with the guest.
The concern is also true for content_shell, since anyone who embeds Chrome is facing a similar risk if they don't disable the browser plugin.

BUG=154360
TEST=Tested with content_shell, by default browser plugin doesn't load anymore. content_browsertests would also not run, made the change to enable them.
Ran Tests:
content_browsertests:BrowserPluginHostTest*
content_browsertests:BrowserPluginTest*
browser_tests:BrowserTag*

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=161142

[jam, 2012-10-06 01:41:46]

can you explain why you're disabling it in content_shell by default?

[lazyboy, 2012-10-06 01:55:09]

"""
Enabling browser plugin in regular pages (other than apps), breaks same origin
policy: The embedder is allowed to inject javascript: URLs into the browser
plugin, and it will soon be able to call executeScript.  That means the embedder
can do whatever it wants with the guest.
The concern is also true for content_shell, since anyone who embeds Chrome is
facing a similar risk if they don't disable the browser plugin.
"""
I've update the CL description and added discussion notes from creis@ and
jschuh@ to the bug.

[Charlie Reis, 2012-10-08 16:47:20]

LGTM, but John, can you approve as well?  We do want this behind a flag in
content_shell, at least until/unless we can come up with a safe-by-default API
subset.

https://chromiumcodereview.appspot.com/11035070/diff/2001/content/public/comm...
File content/public/common/content_switches.cc (right):

https://chromiumcodereview.appspot.com/11035070/diff/2001/content/public/comm...
content/public/common/content_switches.cc:250: // Enables browser plugin for
regular pages as well (not just apps).
The "not just apps" part doesn't make sense in the content module, which doesn't
know about apps.  Just "Enables browser plugin for all types of pages" would
probably work.

https://chromiumcodereview.appspot.com/11035070/diff/2001/content/shell/shell...
File content/shell/shell_content_renderer_client.cc (right):

https://chromiumcodereview.appspot.com/11035070/diff/2001/content/shell/shell...
content/shell/shell_content_renderer_client.cc:43: // Allow browser plugin in
content_shell only if it is forced by flag.
The behavior of this API isn't immediately obvious, so maybe add "Returning
false here disables the plugin."

[lazyboy, 2012-10-08 19:23:57]

https://chromiumcodereview.appspot.com/11035070/diff/2001/content/public/comm...
File content/public/common/content_switches.cc (right):

https://chromiumcodereview.appspot.com/11035070/diff/2001/content/public/comm...
content/public/common/content_switches.cc:250: // Enables browser plugin for
regular pages as well (not just apps).
On 2012/10/08 16:47:20, creis wrote:
> The "not just apps" part doesn't make sense in the content module, which
doesn't
> know about apps.  Just "Enables browser plugin for all types of pages" would
> probably work.

Done.

https://chromiumcodereview.appspot.com/11035070/diff/2001/content/shell/shell...
File content/shell/shell_content_renderer_client.cc (right):

https://chromiumcodereview.appspot.com/11035070/diff/2001/content/shell/shell...
content/shell/shell_content_renderer_client.cc:43: // Allow browser plugin in
content_shell only if it is forced by flag.
On 2012/10/08 16:47:20, creis wrote:
> The behavior of this API isn't immediately obvious, so maybe add "Returning
> false here disables the plugin."

Done.

[jam, 2012-10-10 16:17:17]

lgtm

[commit-bot: I haz the power, 2012-10-10 17:01:18]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/lazyboy@chromium.org/11035070/11001

[commit-bot: I haz the power, 2012-10-10 19:03:43]

Change committed as 161142