Remove inline JS and CSS.

When using inline JS and CSS, you cannot easily set a cross-browser CSP.
Chrome respects SHA hashes of inline content, but Firefox (even the
nightly) and Safari do not. Moving the assets to external files allows
them to be checked via CSP.