Fix broken content scripts in Firefox

Related commit:
- https://github.com/gorhill/uMatrix/commit/9b292304d33a

Forgot to declare `/js/vapi.js` as first content script
to inject.

platform/firefox/manifest.json

@@ -20,7 +20,7 @@
     "content_scripts": [
     {
         "matches": ["http://*/*", "https://*/*"],
-        "js": ["/js/vapi-client.js", "/js/contentscript-start.js"],
+        "js": ["/js/vapi.js", "/js/vapi-client.js", "/js/contentscript-start.js"],
         "run_at": "document_start",
         "all_frames": true
         },

src/js/contentscript-no-workers.js

@@ -25,8 +25,8 @@
 // borrowed from NoScript:
 // https://github.com/hackademix/noscript/commit/6e80d3f130773fc9a9123c5c4c2e97d63e90fa2a
 
-(function() {
-    let html = document.documentElement;
+(( ) => {
+    const html = document.documentElement;
     if ( html instanceof HTMLElement === false ) { return; }
 
     let meta;
@@ -45,8 +45,8 @@
     //
     // The CSP directive is enforced as soon as the meta tag is inserted:
     // > Enforce the policy policy.
-    let head = document.head,
-        parent = head;
+    const head = document.head;
+    let parent = head;
     if ( parent === null ) {
         parent = document.createElement('head');
         html.appendChild(parent);