Fix permissions for Greasemonkey in Firefox

The script didn't work when running in Firefox with Greasemonkey,
because the GM_* methods have to be explicitly granted now. Added
permission for the GM_xmlhttpRequest method, which is used to
retrieve the rating from Goodreads.