Move permission help page into a new dir

(for better separation from PDF.js content)

Also, use location.assign() instead of replace()
(Better for History)
Add a note about HTML
Verify that it's a file URL

... and only show the permission pase in those cases.

(Theoretically, executeScript() might fail for other cases,
too, even if we have never seen any cases for that.)