fx-compat: Fix zotero:// protocol for reports (#2825)

- The protocol can no longer be marked "dangerous to load," only "UI resource"
  (accessible inside browsers but not by web pages).
- The protocol needs to run in the main process.
- We need to replace the XUL browser to reset its type attribute depending on
  whether we're loading a zotero protocol URI - zotero protocol URIs, maybe due
  to the protocol handler's tight coupling with the main process, cannot load in
  type="content" browsers.

components/zotero-protocol-handler.js

@@ -1240,7 +1240,9 @@ ZoteroProtocolHandler.prototype = {
 		
 		return Ci.nsIProtocolHandler.URI_NORELATIVE
 			| Ci.nsIProtocolHandler.URI_IS_LOCAL_RESOURCE
-			| Ci.nsIProtocolHandler.URI_DANGEROUS_TO_LOAD;
+			// URI_IS_UI_RESOURCE: more secure than URI_LOADABLE_BY_ANYONE, less secure than URI_DANGEROUS_TO_LOAD
+			// This is the security level used by the chrome:// protocol
+			| Ci.nsIProtocolHandler.URI_IS_UI_RESOURCE;
 	},
 	get defaultPort() {
 		return -1;