security: add explicit Content Security Policy to manifest

MV3 has restrictive CSP defaults, but an explicit policy documents the
intended security posture, prevents accidental relaxation during future
development, and makes the extension's trust boundary auditable at a
glance.

Co-Authored-By: claude-flow <ruv@ruv.net>

Author: DreamLab-AI Mega-Sprint

manifest.json

@@ -3,6 +3,9 @@
   "name": "Podkey",
   "version": "0.0.7",
   "description": "did:nostr and Solid authentication extension - NIP-07 wallet for decentralized identity",
+  "content_security_policy": {
+    "extension_pages": "script-src 'self'; object-src 'self'"
+  },
   "permissions": [
     "storage",
     "webRequest"