Bug 337223: Don't expose moz-anno protocol to web pages.

Patch by brettw
r=jst
sr=bzbarsky

caps/src/nsScriptSecurityManager.cpp

@@ -1281,7 +1281,7 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
         { "chrome",          ChromeProtocol },
         { "file",            PrefControlled },
         { "https",           AllowProtocol  },
-        { "moz-anno",        ChromeProtocol },
+        { "moz-anno",        DenyProtocol   },
         { "mailbox",         DenyProtocol   },
         { "pop",             AllowProtocol  },
         { "imap",            DenyProtocol   },