rename startupTimer to performance, support mark and measure, drop promise support, add more marks to slowly phase out old timers

* Add CSP To Root Document

Adds a content security policy to the root vscode document. This limits what can be loaded. Important changes:

* Connect-src is limited to `self` or `https:`
* script-src is limited to `self`
* object and child-src are limited to `self`
* Media allows `self` `http` `https` and `data`

* Add preload to gulp

* Default to none

* Don't use let in preload

This reverts commit b9988fed.

This reverts commit f3ffc2ed.