User-assisted renderer script execution via global CSP stripping

Cross-site scripting in the Wyzie redeem window in truelockmc Streambert before 2.6.0 allows attackers to run renderer script via loaded page content. The wyzie-open-redeem handler in index.js creates the partition:wyzie-redeem session and removes the Content-Security-Policy header from every response with onHeadersReceived, while the redeem window also lacks a setWindowOpenHandler restriction for spawned windows. Exploitation requires a user to open the redemption window and attacker-controlled script in a loaded page; the resulting renderer code can reach renderer-exposed application functions, persist in that session, and affect additional windows opened from it.