security: implement Content Security Policy in manifest.json

[RUDRANSHU11]

🔐 Security Enhancement

The extension's manifest.json had no Content Security Policy (CSP) defined, leaving it vulnerable to script injection attacks.

✅ Changes Made

Added content_security_policy to manifest.json with:

• script-src 'self' — only extension's own scripts allowed, no inline JS
• object-src 'none' — blocks Flash/plugin exploits completely
• base-uri 'none' — prevents base tag injection attacks
• connect-src — restricts API calls to only 3 known providers (Gemini, Groq, OpenAI)
• img-src 'self' data: — extension icons and data URIs only
• style-src 'self' 'unsafe-inline' — required for React inline styles

🧪 Testing

• Load unpacked extension from dist/ — works normally
• API calls to Groq/Gemini/OpenAI still function correctly
• No console CSP errors

[RUDRANSHU11]

hello mentor just review it please let me know it will get except or not