Prevent tracking via "Crooked Style Sheets" attack

[tildelowengrimm]

Without any JS, a site can use CSS to track and report some information about entered-but-not-submitted text, mouse hovers, and link clicks, as well as performing some simple fingerprinting via resolution, UA, & typefaces.

• https://github.com/jbtronics/CrookedStyleSheets
• https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense

Much of this can be mitigated by optimistically loading all CSS-referenced content so that none of those loads are conditioned on user behavior.