fix: preserve page CSP in Chrome extension

[Xichun123]

Summary

• stop installing the global DNR rule that removes Content-Security-Policy and Content-Security-Policy-Report-Only from every frame
• remove the content-script mutation that deletes CSP meta elements
• clean up persisted rule 9999 on startup and extension updates so existing installations are migrated
• add an extension regression test and run it in CI

Root cause

On Chrome 150, the persisted CSP-stripping rule interacts with Tampermonkey's page injection on YouTube. A newly opened YouTube renderer enters a sustained ~100% CPU loop, then stops responding to scan, exec, and CDP.

The repro was isolated on a copied Chrome profile:

• Bridge + Tampermonkey, rule 9999 active: 6/8 CPU samples at ~99-100%; page automation hangs
• same profile and extensions, only rule 9999 removed: 0.3-6% CPU; exec and scan --text-only both succeed

The extension already has a CDP fallback for page execution blocked by CSP, so globally weakening every page's CSP is unnecessary.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features
• cargo test --all-targets --all-features (25 passed)
• node --check for all extension scripts
• node --test tests/*.test.mjs (2 passed)
• exact runtime smoke test on Chrome 150 with the legacy DNR rule removed: YouTube exec and scan --text-only succeed