Make sure scripts in md preview are properly evaluated

Fixes #243454

This restores the previous behavior. If the default security settings are used, scripts will still block blocked by the CSP. If you fully disable the security settings, then we'll try to run them