Provide opt-out option to disable HTTP basic-auth on a webpage

[prbinu]

Cloned from: https://bugs.chromium.org/p/chromium/issues/detail?id=783941

Problem statement:
The issue is that when mail.example.com allows contents with embedded resources (e.g. img tags) loaded from 3rd party servers (say evil.example.com), those endpoints can force HTTP basic-auth to the mail.example.com user by setting basic auth HTTP headers. This can potentially steal user credentials.

Feature request:
A way to disable basic-auth on the top-level web page, that also get applied to all embedded iframes in the page. Many websites do not require basic-auth, yet they are vulnerable to this attack.

@mikewest @clelland

[clelland]

I like this idea, although we'd have to find a way to ensure that it could apply to the image resource at mail.example.com, even when evil.example.com is definitely not going to apply a no-basic-auth policy to itself.