Prohibit cross-IWA navigations via _self or <meta>

Navigations that are
  * initiated by an Isolated Web App
  * target current web contents
  * lead to a cross-origin URL
are incercepted by the throttle and offloaded to a browser window.

Normally, web-originating navigations to isolated-app:// URLs are not
allowed. However, there's a caveat here that ChildProcessSecurityPolicy
allows requesting same-scheme resources (as this child process is
granted the request-scheme permission), which makes cross-IWA
deep-linking possible. This CL explicitly prohibits this.

Bug: 428913764
Change-Id: Ib14592feacc1e1e7bbee5af0f0634f53ceab0dff
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6850406
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Commit-Queue: Andrew Rayskiy <greengrape@google.com>
Cr-Commit-Position: refs/heads/main@{#1504076}