Don’t extend/override `String.prototype`

By using private functions instead, security issues with hacky workarounds like https://github.com/esheri3/OWASP-CSRFGuard/pull/52 are avoided. It also ensures that other scripts that rely on the native ES6 `String.prototype.{starts,ends}With` behavior won’t break the moment someone adds CSRFGuard to the page.