Herbal medicines sold online frequently contain dangerous levels of lead, arsenic and mercury, a study suggests.