Restrict AWMI to trustworthy HTTP/HTTPS origins

- Only expose the API on SecureContexts.
- Only allow calling the API from potentially trustworthy HTTP/HTTPS
  origins. Render will verify this and throw a helpful error if on an
  inappropriate origin. The browser enforces this condition before
  binding the Mojo receiver.
- Enforce in the browser-side implementation that the API only works on
  true HTTPS origins (without supporting loadDataWithBaseURL) by
  checking that the last committed origin and URL agree on scheme.

Bug: 330151742
Change-Id: I6abde47b0cb0edfe06c0e0a2cfcb32ffb5c7a194
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5455111
Reviewed-by: Peter Beverloo <peter@chromium.org>
Commit-Queue: Ashley Newson <ashleynewson@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1289369}