Allow scripts in inline ToS/PP pages (issue #3987)

This allows scripts to run, but not to access local assets. Even if an attacker specified a page on the persona origin, it would run in a unique origin that would not have access to the local storage.