manifest.json: remove webRequest from permissions