Fix [bug959277] - Added CSP into Goggles in Report-Only mode. Added 'click' handler to 'Activate X-Ray Goggles' button

[bug959277] - Added CSP into middleware, app; added hood into pakage.json

[bug959277] Removed useless lines

[bug959277] - Added more policies, changed link url to 'https:' protocol

[bug959277] - Added more sources to policy

[bug959277] - Added click handler to pass CSP, removed useless comment.

[bug959277] - changed click handler to jquery style

[bug959277] - Removed function closure;removed #bookmarklet-url

[bug959277] - changed quotes