CSP fixer improvements

@umop 

* Ignore special directories (ones starting with a `.`)
* Do not create backup sources by default (see the comment in one of the commits in this PR as to why)
* Most importantly, throttle the number of concurrent fixing threads to unfreeze the UI somewhat. It's just a stop-gap solution for now; a proper one will use a service worker (there's a TODO in the code, but I'll file a bug as well).

Removed the check, since it was a misguided one anyways: it only tested the top-level folder of the request; `workspace.traverse` would still do its own thing. Luckily, `traverse` already checks for SCM special folders like `.git`, although that wasn't updated with `.bower-git` when it was added recently (I'll fix that in a separate PR).