proxy.username and proxy.password from the /v1 API were interpolated
directly into the generated background.js via %s string formatting
with no escaping, allowing a crafted value to break out of its string
literal and execute arbitrary JavaScript inside the privileged
MV3 extension service worker (host_permissions: <all_urls>, tabs,
webRequest, storage, webRequestAuthProvider).
Encode scheme/host/port/username/password with json.dumps() so none
of them can escape their intended JS literal position.
Co-authored-by: carfeii <carfeii@users.noreply.github.com>
