security(webview): lock down the dashboard WebView

The Clash/yacd dashboard WebView loads a user-editable URL (DataStore.yacdURL) with
JavaScript + DOM storage enabled (the yacd SPA requires both). Everything else is now
explicitly locked down so that page can never read the device filesystem or content
providers, escalate from file:// origins, downgrade to cleartext on an https page, or
spawn JS popups:

- allowFileAccess = false
- allowContentAccess = false
- allowFileAccessFromFileURLs = false
- allowUniversalAccessFromFileURLs = false
- mixedContentMode = MIXED_CONTENT_NEVER_ALLOW
- javaScriptCanOpenWindowsAutomatically = false; setSupportMultipleWindows(false)

Verified on-device: the yacd dashboard (MetaCubeX/yacd 0.3.6) still loads and runs from
http://127.0.0.1:9090/ui — no access-denied / mixed-content errors.

Author: hawkff

app/src/main/java/io/nekohasekai/sagernet/ui/WebviewFragment.kt

@@ -35,8 +35,25 @@ class WebviewFragment : ToolbarFragment(R.layout.layout_webview), Toolbar.OnMenu
         // webview
         WebView.setWebContentsDebuggingEnabled(BuildConfig.DEBUG)
         mWebView = binding.webview
-        mWebView.settings.domStorageEnabled = true
-        mWebView.settings.javaScriptEnabled = true
+        mWebView.settings.apply {
+            // The Clash/yacd dashboard is a JS SPA talking to the local Clash API, so JS
+            // and DOM storage are required. Everything else is locked down: the dashboard
+            // (a user-editable URL) must never be able to read the device filesystem or
+            // content providers, escalate from file:// origins, or downgrade to cleartext
+            // resources on an https page.
+            javaScriptEnabled = true
+            domStorageEnabled = true
+            allowFileAccess = false
+            allowContentAccess = false
+            @Suppress("DEPRECATION")
+            allowFileAccessFromFileURLs = false
+            @Suppress("DEPRECATION")
+            allowUniversalAccessFromFileURLs = false
+            mixedContentMode = WebSettings.MIXED_CONTENT_NEVER_ALLOW
+            // No automatic JS-initiated window.open popups.
+            javaScriptCanOpenWindowsAutomatically = false
+            setSupportMultipleWindows(false)
+        }
         mWebView.webViewClient = object : WebViewClient() {
             override fun onReceivedError(
                 view: WebView?, request: WebResourceRequest?, error: WebResourceError?