[Android] Java Bridge: handle requests from Java Script on the background thread

This allows the page code that calls into injected objects methods to run even
if the browser UI thread is blocked (in WebView, the browser UI thread is the main
app thread, and sometimes people use synchronization primitives there that wait
on some action performed by the injected object, see the bug for an example).

In this CL, we make the minimal required amount of changes in order to simplify
cherry-picking into older branches. A cleanup CL (or CLs) will follow.

High-level description of changes:

 1. We intercept messages from renderers on the IO thread using BrowserMessageFilter
    and handle Java Bridge messages entirely on the background thread. This implies
    the following changes:

 2. GinJavaBridgeDispatcherHost has become RefCountedThreadSafe
    (via BrowserMessageFilter)

 3. We have to use route IDs of RenderFrameHosts instead of pointers to them, as
    we can't access RFHs from IO or background threads.

 4. Objects registry is now accessed from UI and background threads, and we have to use
    locking. We can't anymore restrict access to the registry to a single thread.
    This also means we can't anymore implement the registry using IDMap, as it is
    explicitly non-thread-safe.

 5. A lot of code was removed, as we now serve synchronous requests from renderers
    without inter-thread hopping!

 6. Of course, a new regression test has been added that now passes.

BUG=438255

Review URL: https://codereview.chromium.org/772123002

Cr-Commit-Position: refs/heads/master@{#307460}
9 files changed