refactor: tighten CSP

[WofWca]

TODO:

• Finish MV3 migration

(Content Security Policy)

Although this unfortunately does not affect content scripts:
https://developer.chrome.com/docs/extensions/reference/manifest/content-security-policy

applies to page and worker contexts in the extension. This would include the extension popup, background worker, and tabs with HTML pages or iframes that were opened by the extension

I also tried to sandbox the local-file-player, but there
we're using getURL for dynamic imports.