Fix CSP initialization in sandboxed iframes

[calebporzio]

What this fixes

Closes #4892.

The CSP build snapshots values from globalThis when the module loads so the evaluator can reject global objects later. Some browser globals are accessors that can throw when unavailable; in a sandboxed iframe without allow-same-origin, reading localStorage throws a SecurityError and aborts Alpine before initialization.

Changes

• Skip global properties whose getters throw while building the CSP global-value set.
• Add a browser regression fixture that runs the CSP build in an opaque-origin iframe and verifies x-data/x-text initialize.

Verification

• Confirmed the new Cypress regression fails on unpatched main.
• npm run build
• npx cypress run --browser chrome --spec tests/cypress/integration/plugins/csp-compatibility.spec.js
• npx vitest run tests/vitest/csp-parser.spec.js