fix: override csp for frame-src

[hugomano]

What is this PR

• Fixed a bug about CSP: trusted protocol chrome-extension:// is not bypassed in CSP check at the iframe document level, so we add it to the frame-src to the directive in the Content Security Policy header More here
• ~Revamped the protocol handler and added verification for web accessible resources~

How to test

• CSP

• [ ] before this PR: log in Gmail with a @gmail.com account, onboarding iframe is not displayed.

• [ ] after this PR: log in Gmail with a @gmail.com account, onboarding iframe is displayed

• Protocol Handler In the Gmail dev tool with the Mixmax contex console:

• [ ] ~fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/manifest.json', { mode: 'no-cors' }).then(console.log) response is net::FAILED~

• [ ] ~fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/src/iframeProxy/proxy.html', { mode: 'no-cors' }).then(console.log) response is HTTP 200~

• [ ] ~fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/src/iframeProxy/proxy.js', { mode: 'no-cors' }).then(console.log) response is HTTP 200~

[alexstrat]

:+1: As discussed, this should be only on the resources listed as web_accessible_resources

[hugomano]

https://github.com/electron/electron/issues/12909#issuecomment-389225310