[Thread-safe] Apply base::Passed to WebThread::Task

[Thread-safe] Apply base::Passed to WebThread::Task

WebThread::Task can contain RefPtr to a thread-unsafe-reference-counted object
(e.g. WorkerThreadTask can contain RefPtr to WebKit's StringImpl).
This caused a race condition:

[A] When WebThread::Task::run is executed, more RefPtr's to the refcounted
    object can be created and the reference counter of the object can be
    modified via these RefPtr's (as intended) on the thread where the task
    is executed.
[B] However, base::Closure still retains the ownership of WebThread::Task
    even after WebThread::Task::run is called.
    When base::Closure is deleted, WebThread::Task is deleted and the
    reference counter of the object is decreased by one, possibly from a
    different thread from [A], which is a race condition.

This CL removes the ownership of WebThread::Task from base::Closure after
WebThread::Task::run is executed by using scoped_ptr and base::Passed.
This removes the reference counter modification of [B] and hence removes the
race condition.

BUG=390851

Review URL: https://codereview.chromium.org/807423002

Cr-Commit-Position: refs/heads/master@{#309396}