[CRX] enableScripting=false by default in Chrome extension

The scripting engine is bundled for users who'd like to use the feature,
but it is disabled by default.

extensions/chromium/preferences_schema.json

@@ -69,6 +69,12 @@
       "type": "boolean",
       "default": false
     },
+    "enableScripting": {
+      "title": "Enable active content (JavaScript) in PDFs",
+      "type": "boolean",
+      "description": "Whether to allow execution of active content (JavaScript) by PDF files.",
+      "default": false
+    },
     "disableRange": {
       "title": "Disable range requests",
       "description": "Whether to disable range requests (not recommended).",
@@ -154,10 +160,6 @@
       ],
       "default": 2
     },
-    "enableScripting": {
-      "type": "boolean",
-      "default": true
-    },
     "enablePermissions": {
       "type": "boolean",
       "default": false

web/app_options.js

@@ -101,7 +101,7 @@ const defaultOptions = {
   },
   enableScripting: {
     /** @type {boolean} */
-    value: true,
+    value: typeof PDFJSDev === "undefined" || !PDFJSDev.test("CHROME"),
     kind: OptionKind.VIEWER + OptionKind.PREFERENCE,
   },
   externalLinkRel: {