Widget: Extract script to widget.js

[runephilosof-abtion]

Apart from separating concerns. This also has the benefit of making it possible to add a secure csp without script-src unsafe-inline