webkit2gtk localStorage error: "this operation is insecure"

I'm building a single-page app using seed and rollup, and a native wrapper using inline-assets, rust-embed and web-view (all glued together using npm and rust build scripts).

When I serve my single html file or load it locally (as a `file://` url) in epiphany, firefox or chromium it works just fine, but when I embed it into the native wrapper and load the entire html contents using `WebViewBuilder::content` it complains about the operation being insecure (the exact error is in the issue title).

I assume this is due to how web-view loads the entire file as a `data:` url, and have tried various csp configurations to fix this (using my personal fork of the rollup html plugin that adds file hash csp directives along with any other csp directives it's configured to add, without the file hash directives i'd have to enable `unsafe-inline` for scripts).

I've tried allowing `unsafe-inline` for `default-src` and `script-src` and allowing `data:` for `default-src` but nothing worked, it always crashes with an extremely long message (as long as my index.html) that makes debugging impossible because the console chokes on such a giant error and freezes (when I redirect the error message to a file it takes up about 10 mb of space).

Here's how the error looks, not too helpful:
```
CONSOLE JS ERROR Unhandled Promise Rejection: error retrieving oauth state from local store: GetStorageError(
JsValue(SecurityError: The operation is insecure.
data:text/html, # the entire contents of index.html as a urlencoded string...
)
)
```

Is there any way to bypass this using csp?

Thanks in advance.

Start with the native wrapper's WebViewBuilder::content path and reproduce the localStorage failure with the embedded data: URL, comparing it with the working file:// case. Review the reported CSP configurations and the OAuth state lookup, then determine whether CSP provides a fix or whether the limitation needs to be documented.

Written by the indexing model from the issue text.