fix: allow 'unsafe-eval' in web worker extension host CSP (1.2) - #302

Issue

#301

Description of Changes

Extensions that run in the web worker extension host and ship CommonJS code (e.g. vscodevim.vim) fail to activate with:

EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script ... script-src 'self' 'wasm-unsafe-eval' ...

The web worker extension host loads CommonJS extension code via new Function(), which CSP only permits under 'unsafe-eval'. 'wasm-unsafe-eval' covers WebAssembly only.

This ports the fix from #141 (1.0) and #142 (1.1), which did not reach main, so 1.2 was cut without it:

• common/preapplied/remove-unsafe-headers.diff: drop the webWorkerExtensionHostIframe.html hunk so the worker iframe keeps upstream's 'unsafe-eval'. The other CSP changes in this patch are unchanged.
• common/replace-inline-sha-with-placeholder.diff, web-embedded/remove-unsafe-eval-and-unsafe-inline-from-csp-direct.diff: update context lines accordingly. The resulting web-embedded CSP is unchanged.

Testing

• prepare-src.sh applies cleanly for all four targets; no new offsets/fuzz compared to current 1.2.
• Resulting worker iframe CSP:
  • code-editor-sagemaker-server, code-editor-server: script-src 'self' 'unsafe-eval' 'sha256-…' (same inline script hash as before)
  • code-editor-web-embedded, code-editor-web-embedded-with-terminal: unchanged
• Reproduced on the 1.2.1 code-editor-sagemaker-server release: vscodevim.vim fails to activate with the error above. With this change applied, Vim activates and enters NORMAL mode with no errors.
• Verified 1.0.14 and 1.1.10 releases are not affected.

Additional Notes

Matches upstream Code-OSS, which uses 'unsafe-eval' in this iframe. The worker extension host runs in a sandboxed iframe/web worker.

Backporting

• 1.0, 1.1: already fixed (relax CSP policy to address vim extension installation problem #141, relax CSP policy to address vim extension installation problem #142).
• main: separate PR to follow.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.