Proposal: stop adding `host_permissions` from `content_scripts`

Currently when using specific matches in content_scripts, they will be added to the list of host_permissions the extension requests / has access to (in some cases, only when granted).

My proposal is to stop this behavior and require devs to define this in either host_permissions, optional_permissions or permissions. This would align it with other APIs like the webRequest API. In addition to aligning it with other APIs, there are two more reasons for this change:

1. Some host_permissions you only want to apply in specific cases. So the content_scripts will only be applied when the host_permissions are granted. This makes sure not all host_permissions are required to be granted right from the install of the extension.

2. When having multiple content_scripts and matches, you will end up polluting the host_permissions. Say you have matches like these: "https://example.com/*something=true*", "https://example.com/*something=false*", "https://example.com/*test=true*". All of them will be added to the host_permissions causing conflicts with granting / removing permissions for specific domains. Easy solution here would just be to add https://example.com/* to the permissions.

Due to the backward compatibility issues, this may only be doable for manifest v4.

Start by reviewing how content_scripts currently affect host_permissions, then compare the proposed explicit use of host_permissions, optional_permissions, or permissions. Consider the manifest v4 compatibility constraint and the backward-compatibility discussion. Done means the specification defines the changed permission behavior and its compatibility implications.