Unfortunately the first two options aren't really viable if you're an ad supported website. HTTPS will kill your ad revenue since most ad scripts don't work properly over HTTPS.
The good thing is that at least most browsers these days are good at blocking mixed content so you won't have HTTP adds growing tumors due to injections anyhow.
What i don't understand is why AT&T has to do injection in the 1st place they can easily setup their own AdNetwork and partner with the large AdNetworks to route through AT&T's own internal servers.
Adnetworks are saving bandwidth, AT&T doesn't have to fight with HTML injection which can break on many sites, AdNetworks get better targeted advertisement win for everyone...