move to altcha dist_external to elide dependency on blob source in CSP

reference: https://altcha.org/docs/website-integration/#content-security-policy-csp

manifest.json

@@ -1,7 +1,7 @@
 {
     "manifest_version": 2,
     "name": "Slop Farmer",
-    "version": "0.5.2",
+    "version": "0.5.4",
 
     "author": "Jack Case",
     "description": "Crowd-source AI slop pages and domains",
@@ -13,7 +13,7 @@
         "*://*.duckduckgo.com/*"
     ],
 
-    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; worker-src 'self'",
+    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; worker-src 'self'",
 
     "browser_action": {
         "default_title": "Slop Farmer",