chore: rework csp
breaking feat: plugin manifest no longer accept script
feat: logging malformed hash