What stops a rogue extension from accessing the OPFS using navigator.storage.getDirectory() by injecting a