fix: allow 'unsafe-eval' in web worker extension host CSP - #303

Issue

#301

Description of Changes

Extensions that run in the web worker extension host and ship CommonJS code (e.g. vscodevim.vim) fail to activate with:

EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script ... script-src 'self' 'wasm-unsafe-eval' ...

The web worker extension host loads CommonJS extension code via new Function(), which CSP only permits under 'unsafe-eval'. 'wasm-unsafe-eval' covers WebAssembly only.

This ports the fix from #141 (1.0) and #142 (1.1), which did not reach main (same change as #302 for 1.2):

• common/preapplied/remove-unsafe-headers.diff: drop the webWorkerExtensionHostIframe.html hunk so the worker iframe keeps upstream's 'unsafe-eval'. The other CSP changes in this patch are unchanged.
• common/replace-inline-sha-with-placeholder.diff, web-embedded/remove-unsafe-eval-and-unsafe-inline-from-csp-direct.diff: update context lines accordingly. The resulting web-embedded CSP is unchanged.

Testing

• prepare-src.sh applies cleanly for all four targets; no new offsets/fuzz compared to current main.
• Resulting worker iframe CSP:
  • code-editor-sagemaker-server, code-editor-server: script-src 'self' 'unsafe-eval' 'sha256-…' (same inline script hash as before)
  • code-editor-web-embedded, code-editor-web-embedded-with-terminal: unchanged
• Reproduced on the 1.2.1 code-editor-sagemaker-server release: vscodevim.vim fails to activate with the error above. With this change applied, Vim activates and enters NORMAL mode with no errors. The resulting webWorkerExtensionHostIframe.html on main is identical to the one tested.
• Verified 1.0.14 and 1.1.10 releases are not affected.

Additional Notes

Matches upstream Code-OSS, which uses 'unsafe-eval' in this iframe. The worker extension host runs in a sandboxed iframe/web worker.

Backporting

• 1.0, 1.1: already fixed (relax CSP policy to address vim extension installation problem #141, relax CSP policy to address vim extension installation problem #142).
• 1.2: fix: allow 'unsafe-eval' in web worker extension host CSP (1.2) #302.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.