Tracking: remove `style-src: 'unsafe-inline'` from CSP

[iliana]

• xterm.js: Requires unsafe-inline for the default renderer. Could switch to another renderer, write our own renderer, or contribute nonce support upstream (this was their original plan, but they tried constructed style sheets instead, which broke VS Code...)