Allow html requests to be properly cancelled

[davidwengier]

Part of #11759

I'm not honestly sure what I was thinking in not passing on the cancellation token. The idea of "well we might need this work later, lets run it in the background" might have made some sense (though likely not, as Roslyn essentially does the same sort of thing with its compilation tracker) but since none of the tasks here are fire and forget, nor do we want them to be, there was never any real cancellation.

It's purely anecdotal, but this seems to have fixed (or at least reduced) the amount of cancellation happening (and erroneously logged errors due to cancellation), I think because new requests would come in (or things might have been timing out) after old requests were cancelled by the client, but of course we never honoured that.