fix(icon): remove svgSrc, only allow trusted urls

[jelbourn]

DO NOT MERGE UNTIL DEC 5th

R: @kara @andrewseguin
CC: @rjamet

This makes all SVG APIs on MdIconRegistry take a SafeResourceUrl instead of a string. This means that users must explicitly trust any URL used to load an SVG icon. This is necessary because we inline the SVGs into the document via innerHTML.

This also completely removes svgSrc from <md-icon> because it is not ergonomic to use with trusted URLs. We can explore adding it back in the future if we add support for a compile-time SVG cache.

[jelbourn]

@andrewseguin can you review?

[andrewseguin]

LGTM

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}