Fix popup

Major update: full context coverage + optional User-Agent spoofing.

What's new:
• Optional User-Agent spoofing — override navigator.userAgent, platform, language and userAgentData from the popup.
• Service Worker support — timezone and UA patches now apply inside Service Workers via declarative network response filtering.
• Dedicated & Shared Worker support — workers are transparently wrapped so the spoof is applied before the site's code runs.
• Robust iframe handling — nested iframes are patched via contentWindow getter interception, including dynamically created ones.
• Consistent cross-context spoofing — main page, iframes, and all worker types now report the same timezone and UA values.
• CSP-safe injection — main-world script is injected by the browser itself (world: MAIN), bypassing strict Content-Security-Policy without DOM manipulation.