Allow data: scheme for images in CSP

[max-baz]

Per https://stackoverflow.com/a/18449556 it seems we need to whitelist data: scheme.

This bug appeared because light theme PR for the first time introduced select box in the options screen, and browser styles arrow in the select box using an image constructed with data:.

I think there's no harm security-wise in allowing data: scheme, what do you think?

Fixes #184

[erayd]

Security-wise I think this is OK. It doesn't locate the root cause, but given the source isn't in our codebase or any of our dependencies, it seems like a reasonable compromise.

There are some remote inclusion vectors in XML which may or may not be exploitable via the SVG parser, but given that you'd still need to compromise the extension first before you could inject it (at which point you'd already have JS execution), I think it's acceptable.