Do we want to clean up all dependencies on safe browsing, or only the ones to chrome/browser/safe_browsing? I think there is only one non-test dependency on c/b/sb and that should be gone with crrev/2503243003. The rest seem to be depending on the safe browsing component instead.

Or do we also want to do clean up all dependencies, even for tests?

Also I think there is an other option: move most (all?) of the reporting code to safebrowsing. I haven't yet checked how feasible this is.