Fix GM_listValues() by passing only plain strings.

Plain strings can cross security boundaries without issues.  So in privileged scope return (JSON.stringify()ed) just a string, then in the sandbox scope decode that string.

Refs #2004
Just BARELY working script installs.

Refs #2004