Content script injection breaks iCloud sign-in (CSP conflict)

### Steps To Reproduce

1. Add icloud.com, apple.com, and idmsa.apple.com to Blocked Domains in Bitwarden settings.
2. Go to icloud.com and start the sign-in flow.
3. Reach the two-factor step ("Use a security key to sign in to your Apple Account") and try to click Continue.

### Expected Result

Continue button triggers the WebAuthn / security key prompt. Bitwarden does not inject anything on the blocked domain.

### Actual Result

The Continue button does nothing and produces no network request. The browser console shows CSP violations originating from Bitwarden's content.js, e.g. inline script blocked by script-src. iCloud's own route scripts also fail to load. Disabling the Bitwarden extension entirely resolves the issue immediately, but adding the domains to Blocked Domains does not.

### Screenshots or Videos

_No response_

### Additional Context

The Bitwarden content script is injected into pages even when the domain is listed under Blocked Domains, so users cannot exclude a site to avoid Content-Security-Policy conflicts. The only workaround is disabling the extension.

### Operating System

Windows

### Operating System Version

11 Pro, 24H2

### Web Browser

Firefox

### Browser Version

153

### Environment Versions

Version: 2026.7.0
SDK: 'main (3e060f8)'
Server version: 2026.7.1

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Reproduce the failure in Firefox 153 on iCloud with the domains blocked, then inspect the Bitwarden content.js injection path and the CSP violations shown in the browser console. Done means blocked domains prevent the content script from being injected, the iCloud route scripts load, and the Continue button reaches the WebAuthn/security-key prompt.

Written by the indexing model from the issue text.