Bug
Lots of webview extensions do not set a content security policy in their webview content. We want all webviews to have CSP as this can block many common security issues

Proposal
Log a warning if a webview is created that does not have a CSP. Potentially also add some telemetry on which extension are generating these webviews so we can eagerly open bugs against them