Improved heuristics for detecting TPRs in gadet code

Reduce false positives by combining a few conditions:

• Single-line or multiple-line comments are ignored during code scan
• Gadget code contains some URLs that aren't part of the allow-list
• Gadget code matches abritrary rules such as the presence of mw.loader or iframe.

Still, some gadgets won't be caught if they load TPRs in a way that evades those rules.

Bug: T335892