support extension secret

like how plugins have secrets using userSettings i need a way to pass secret to my script or some other safe way. not sure if localStorage is free from logging/syncing etc. loading it from CDN defeats the point of secrecy since its public or if u embed apikey in the cdn somehow then it can get logged