Allowed to download shouldn't consult browsing contexts

[annevk]

They have no authority, documents/globals do.

[domenic]

To actually solve this in the way @annevk prefers, we would probably need to switch the entire sandboxing flags infrastructure to be document based instead of BC-based. It sounds like that's a future goal of policy container (#4926), but not happening soon. /cc @ArthurSonzogni

In the meantime, I think we can make this better (in particular to help #1130) by computing "allowed to download" in the synchronous section. That appears to match what Chrome does: https://source.chromium.org/chromium/chromium/src/+/master:content/renderer/render_frame_impl.cc;l=5906-5922;drc=587068ee20325543d40cbd4bf50bed6af51ee23e