webview-based login support

[iamhyc]

TODOs:

service worker proxy verification

vscode did prevent this kind of attack from service worker:

• service worker cannot fetch worker script due to:
  • webview is in vscode-webview:// origin, and any fetch request to this origin is forbidden;
  • worker script could only be fetched from webviewUri with origin "https://....", which is in different origin from webview;
  • you can pre-fetch worker script as blob url, but service worker is forbidden to load from it;
• iframe loading from webviewUri is forbidden, so no further worker script can be loaded;
• iframe loading from blob Uri is possible, but this origin does not parse worker script uri correctly;

[iamhyc]

abandoned due to above restrictions