Ensure CanAccessDataForOrigin can only be called on UI thread.

This CL introduces a new kRestrictCanAccessDataForOriginToUIThread
feature (disabled by default) that ensures
ChildProcessSecurityPolicy::CanAccessDataForOrigin can only be called
on the UI thread, since other threads do not have sufficient
information to perform the full set of checks. All current calls now
match this expectation, and once the feature is enabled, the checks
will prevent new code from breaking the invariant.

Note that disabling kSupportPartitionedBlobUrl also disables these
new checks, since the old blob URL code makes some
CanAccessDataForOrigin calls on the IO thread.

Bug: 1286501, 1286533
Change-Id: I7868f1fb77ec01c88da0b75af01e4ff1573e8365
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4107698
Commit-Queue: Sharon Yang <yangsharon@chromium.org>
Reviewed-by: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1084182}