Unable to use extensions that depend on unsafe-eval policy, in code-editor

Description:
The change in the security policy from `unsafe-eval` to `wasm-unsafe-eval` stops JavaScript from turning strings into runnable code.

- Vim is a CommonJS format extension.
- When Code Editor loads a CommonJS extension in the web/worker host, it wraps the code string in a function and executes it.
- In the Code Editor space, the new CSP policy blocks that step, so it fails.

`2026-09-10 16:47:24.991 [error] Activating extension vscodevim.vim failed due to an error:
2026-09-10 16:47:24.991 [error] EvalError: Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script: script-src 'self' 'wasm-unsafe-eval' 'sha256-8VDNIuBNbWfgSAsMFpnaas1UmjLKHwTaKfM2t/FPUfc=' https: http://localhost:* blob:".
`

https://www.w3.org/TR/CSP3/#directive-script-src
Per the CSP spec, new Function() is gated only on 'unsafe-eval'; 'wasm-unsafe-eval' "only permits WebAssembly and does not affect JavaScript." So replacing 'unsafe-eval' with 'wasm-unsafe-eval' removes the exact permission the extension loader needs, and the browser throws EvalError.

Ticket ID: D523182748

Start by tracing how Code Editor loads CommonJS extensions in the web/worker host and where the CSP policy is configured. Reproduce activation of the vscodevim.vim extension, then verify that it works under the intended policy without the reported EvalError.

Written by the indexing model from the issue text.