fix: add world: MAIN to Firefox page script registration

[addisonbeck]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-28387
sibling change from the same jira ticket: #17429
pr adding eslint rules to try to catch this pattern in the future: #17437

📔 Objective

This PR enhances how Firefox handles FIDO2 page script registration. The current MV2 implementation uses DOM script injection which exposes extension resource URLs in the page context where websites can observe them.

This PR adds the world: "MAIN" parameter to registerContentScriptsMv2() call in Firefox MV2 registration. This executes scripts directly in the page context without creating observable DOM elements.

It might be wise to also review the HTML I used for testing. It is shared in the Recreation Steps in Jira.

Note For Autofill

Autofill, we are mixing team boundaries a bit here. This change is in autofill code but really page registration as a general concept is probably more of a platform domain. For now I've just made the change needed to patch this bug, but platform will be revisiting this in a later sprint to build out a page registration api your team can call. This is going to be planned on https://bitwarden.atlassian.net/browse/PM-28388

📸 Screenshots

Before and after with me locally serving the HTML shared in Jira

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – b3aa3649-8f30-4e2d-8ac4-804108224f52

Great job! No new security vulnerabilities introduced in this pull request

[claude]

Claude Code is working…

I'll analyze this and get back to you.

View job run

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.20%. Comparing base (e44ab1b) to head (5a1e879).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #17466   +/-   ##
=======================================
  Coverage   41.20%   41.20%           
=======================================
  Files        3543     3543           
  Lines      101912   101912           
  Branches    15282    15282           
=======================================
+ Hits        41988    41995    +7     
+ Misses      58159    58152    -7     
  Partials     1765     1765           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[bw-ghapp]

⚠️ Changes in this PR impact the Autofill experience of the browser client ⚠️

BIT has tested the core experience with these changes and the feature flag configuration used by vault.bitwarden.com

Caution

Unfortunately, one or more of these tests failed. 😞

Please resolve the failure before merging; reach out to @bitwarden/team-autofill-dev if you'd like help.

You can view the detailed results of the tests here.

[bw-ghapp]

⚠️ Changes in this PR impact the Autofill experience of the browser client ⚠️

BIT has tested the core experience with these changes and all feature flags disabled.

Caution

Unfortunately, one or more of these tests failed. 😞

Please resolve the failure before merging; reach out to @bitwarden/team-autofill-dev if you'd like help.

You can view the detailed results of the tests here.