Add surrogate-based replacement placeholders for Rumble and Google reCAPTCHA widgets

[ghostwords]

Fixes #2739, fixes #2796 by implementing a new, surrogate script-driven widget replacement flow to support replacing more complex/dynamic widgets.

We don't (always) know the widget's element selector (because it's dynamically set by the page via a predefined config variable or widget API call). If our hardcoded selectors don't match, we fail to replace. If a widget is always initialized by calling the widget API, we might not have any hardcoded selectors at all.

To be clear, this PR doesn't add a new widget type; we dynamically generate a "type 4" (#2512) widget in the end of this new replacement flow:

1. While filtering requests, we match and redirect a known widget script resource request to the surrogate script for that widget.
2. Our surrogate provides (some of) the replaced widget's API to the page.
3. The page calls that API.
4. Our surrogate sends a message to a listener in a content script.
5. The content script relays that message to the background page.
6. The background page constructs a widget definition object (static definitions live in /src/data/socialwidgets.json) and sends it to the widget replacement content script.
7. The widget replacement content script performs the replacement. This entirely leverages existing functionality.

Messages from our surrogate are not to be trusted as unlike messages from content scripts, surrogate script messages can be easily modified and/or faked by the page. The background page is responsible for validating/sanitizing incoming widget data (content scripts should be kept as simple as possible).

Follows up on #2512, where we added a new widget type (the aforementioned "type 4") that on activation reinserts the replaced element and then also runs the (previously blocked) associated JavaScript resources.

To be followed up with improved Facebook and YouTube surrogates that should let us finally remove Facebook/YouTube domains from the yellowlist (#1593).