Sample: Calling .click() on an element with an inline event handler or link with a javascript: scheme

**Summary**

Manifest V3's CSP for content scripts prevents extensions from executing inline JavaScript. Typically inline script execution would occur when an element has inline event handlers bound or when an anchor tag's href attribute contains a `javascript:` scheme. As a result, if an extension tries to call `.click()` on such an element inside an isolated world content script, Chrome will throw a CSP error.

This demo should show at least one safe way that developers can work around this issue.

**Suggested implementation**

Create a main world script (proxy-click.js?) that performs the click in the main world on behalf of the isolated script. At the moment I see a couple different ways we could approach this.

1. Inject both a main and isolated world script as functions with a nonce as the args. Use this to dispatch a custom event with the nonce in the name in order to prevent other scripts from seeing the messages passed between main and isolated worlds.
2. Inject a main world script a document start, append an event listener to window, & listen for something like 'proxy-click'. When dispatching this event from the isolated world, emit as a capture event and in the handler use `stopPropagation()` to minimize visibility.
3. On demand, inject a main world script function with a CSS selector arg to perform the click.

Of these, at the moment (1) seems best.

**Additional context**

* [Issue 1299742](https://bugs.chromium.org/p/chromium/issues/detail?id=1299742): MV3 content script can't click a web page link with a javascript: URL