Switch remaining CSP-vulnerable main world script injection to scripting API #3053
Description
We already migrated most but not all uses of window.injectScript() to the scripting API:
Let's migrate the rest (search for injectScript in the MV3 branch).
The main problem with window.injectScript() is that it is subject to page CSPs. This means learning from canvas fingerprinting and local storage is broken on sites with restrictive CSPs (like this very site probably). We pollute the page dev tools console and/or the Errors button on chrome://extensions/ when this happens.