fix: postMessage security hardening and highlight grouping

Add per-session nonce to all postMessage exchanges between content
script and iframe, use targeted origin instead of wildcard, add explicit
CSP to manifest. Group consecutive matched characters into single mark
elements to fix visual spacing.

Assisted-by: Claude Code
Signed-off-by: Avinal Kumar <avinal.xlvii@gmail.com>

manifest.json

@@ -13,6 +13,9 @@
     "sessions",
     "storage"
   ],
+  "content_security_policy": {
+    "extension_pages": "script-src 'self'; object-src 'self'; img-src 'self' data:;"
+  },
   "background": {
     "scripts": ["dist/background.js"]
   },