Merge NoScript ChannelReplacement.js
NoScript has renamed IOUtil.js to ChannelReplacement.js in 2.1.4, and slimmed down the functionality a bit. Giorgio also restricted the use of HTTPS.forceURI() to only apply to TYPE_UNKNOWN and TYPE_OBJECT_SUBOBJECT elements as a mitigation against https://bugzilla.mozilla.org/show_bug.cgi?id=677643.
Once Firefox 8 is released, we should re-enable the content policy and merge in his changes, but we're going to opt to leave it entirely disabled for now.