if a private script was to insert a <script> element, and js execution is disabled, the <script> element still should get blocked.

Currently, canExecuteScripts would return true, as the current context belongs to a private script