Support `sandbox`ed `Content-Security-Policy`s

[chriskuech]

Currently, this extension cannot run in GitHub and other sites that have sandbox in their Content-Security-Policy. However, bootstrap.ts does get executed--just not the iframed editor/main.ts. Potentially the logic from editor/main.ts can be moved to bootstrap.ts, but this is likely non-trivial.