Perform security review for all browser extension code

[Melvillian]

For the MVP we are moving fast and ignoring most security concerns while we just get something working. We're following the maxim of

1. Make it work
2. Make it right
3. Make it fast

So once (1) is done we need to go back and do (2), part of which involves hardening the extension.

We don't know everything we need to check, so a non-exhaustive list of things to review are:

1. XSS attacks
2. CSP
3. file access specified in manifest.json
4. limiting the extension's permissions to the minimal needed to find headlines and rewrite the headline
5. Anything else off of the OWASP list