IndexedDB: Fixed cursor/blob use-after-free bug

The IndexedDBDispatcherHost maintains a map of BLOB UUID's to BLOBs, but if two
(or more) cursors are both active and referencing the same BLOB then two (or
more) BLOBs would exist with the same UUID, and their keys would collide in this
map. This change reference counts these BLOBs to avoid duplication.

Also, access to the existing map was not synchronized and was accessed on two
different threads.

BUG=435880,436137

Review URL: https://codereview.chromium.org/774593004

Cr-Commit-Position: refs/heads/master@{#307063}
3 files changed