roam/js scripts are running without permission

[vzaidman]

Describe the bug

I have a use case where a script is running without turning it on.

At least when I added the following js: https://roam.davidvargas.me/extensions/page-synonyms/

To Reproduce

1. add the following to the [[roam/js]] page:

- aliasing:
    - {{roam/js}}
        - ```javascript
var old = document.getElementById("page-synonyms");
if (old) {
  old.remove();
}

var s = document.createElement("script");
s.src = "https://roamjs.com/page-synonyms.js";
s.id = "page-synonyms";
s.async = false;
s.type = "text/javascript";
document.getElementsByTagName("head")[0].appendChild(s);```

2. refresh the page (F5) without approving the script by WITHOUT clicking on "Yes I know what I'm doing"

3. notice the alias feature is actually added. (right click a bullet and it will be at the bottom)

System Information:

• Roam version: 0.7.4-1cf04480
• Device: Desktop computer
• OS: Windows 10
• Browser: Chrome

Additional context

Couldn't reproduce with a simpler script like just console.log('hi')