This is just so I can take a screenshot, so the buttons do not work at the moment.

* Add CSP To Root Document

Adds a content security policy to the root vscode document. This limits what can be loaded. Important changes:

* Connect-src is limited to `self` or `https:`
* script-src is limited to `self`
* object and child-src are limited to `self`
* Media allows `self` `http` `https` and `data`

* Add preload to gulp

* Default to none

* Don't use let in preload