Convoluted blob: URL issue

[annevk]

Browsing context group 1: http://example.com/1 (insecure) embeds https://example.com/2 (insecure due to /1)
Browsing context group 2: https://example.com/3 (secure context)

/2 creates a blob URL that it hands /3 (via storage or BroadcastChannel). /3 embeds it. I think in that case we either want it to be a secure context or block loading, right?

See also whatwg/html#5198 (comment) and onward for similar issues with other policies.

[annevk]

w3c/FileAPI#153 solves this by not allowing /2 and /3 to access the same store. We're experimenting with this in Firefox and would love feedback.