feat: vendor and censor the phishing blocklist at build time (closes #219)

src/content/inpage.js

@@ -179,7 +179,8 @@
             return this;
         },
 
-        // Some dApps (wagmi) check this to confirm MetaMask-like behavior
+        // Some dApps (wagmi) probe this object to decide whether the provider
+        // supports the de-facto standard extras. The name is theirs, not ours.
         _metamask: {
             isUnlocked() {
                 return Promise.resolve(provider.selectedAddress !== null);