Warn on webviews that do not have a content security policy set

[mjbvz]

Bug
Lots of webview extensions do not set a content security policy in their webview content. We want all webviews to have CSP as this can block many common security issues

Proposal
Log a warning if a webview is created that does not have a CSP. Potentially also add some telemetry on which extension are generating these webviews so we can eagerly open bugs against them

[mjbvz]

Documentation we should link to: https://code.visualstudio.com/api/extension-guides/webview#content-security-policy

[mjbvz]

Actually will open a separate issue for tracking fixes