ext-vuln: script-src-elem / script-src-attr passthrough test