<!DOCTYPE html>
<html lang="en" style="width: 100%; height: 100%;">

<head>
	<meta charset="UTF-8">

	<!-- Disable pinch zooming -->
	<meta name="viewport"
		content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">

	<meta http-equiv="X-UA-Compatible" content="ie=edge">
</head>

<body style="margin: 0; overflow: hidden; width: 100%; height: 100%" role="document">
	<script async type="module" src="main.js"></script>
</body>

</html>

<!DOCTYPE html>
<html lang="en" style="width: 100%; height: 100%;">

<head>
	<meta charset="UTF-8">

	<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; frame-src 'self'; style-src 'unsafe-inline';">

	<!-- Disable pinch zooming -->
	<meta name="viewport"
		content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">

	<meta http-equiv="X-UA-Compatible" content="ie=edge">
</head>

<body style="margin: 0; overflow: hidden; width: 100%; height: 100%" role="document">
	<script async type="module" src="main.js"></script>
</body>

</html>

Add content security policy to top level webview
Add content security policy to top level webview

This change hardens our webviews by adding a fairly restrictive csp to them. This CSP should only apply to the outer webview iframe, not to the inner iframe which is controlled by extensions
