remove 'unsafe-eval' in CSP script-src

[roycewilliams]

Following up on this advice from @gorhill, please investigate feasibility / LOE for removing 'unsafe' clauses from the Content Security Policy in the manifest.

disconnect/firefox/content/disconnect.safariextension/opera/chrome/manifest.json

Line 22 in 8793a57

"script-src 'self' 'unsafe-eval'; object-src 'self'",

disconnect/firefox/content/disconnect.safariextension/opera/manifest.json

Line 20 in 8793a57

"script-src 'self' 'unsafe-eval'; object-src 'self'",

Update: also, since blob: and filesystem: are both whitelisted by default within script-src, please configure both of these to explicitly control remote code execution.