fix(street-level): pause Street View details retries after a failure

Maintainer follow-up to #966 review:

- A failed panorama-details lookup now waits DETAILS_RETRY_COOLDOWN_MS
  (5 s) per panorama before a view event can retry it, so dragging the
  view after a failure no longer issues a lookup on every pov change. A
  success clears the pause; one panorama's failure does not delay another.
- SECURITY.md notes that allowing maps.googleapis.com in script-src also
  trusts its JSONP endpoints, an accepted limitation alongside the
  existing 'unsafe-eval' allowance.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/CURRENT-STATE.md

@@ -3108,7 +3108,8 @@ disabled until the camera is at street zoom. The viewer is Google's `StreetViewP
 element in the viewer host, without Google's fullscreen, close and address
 controls (the address goes in the caption); a pose goes out at once and
 again when the panorama's month, photographer and address arrive (one
-lookup per panorama per session, seeded by the nearest lookup). A key
+successful lookup per panorama per session, seeded by the nearest lookup;
+failed details lookups wait five seconds before a view event can retry). A key
 Google refuses (`gm_authFailure`: the API not enabled, a referrer it does
 not allow, billing off) reads KEY REJECTED and fails a pending open at
 once; a lookup or open Google never answers fails after 10 or 20 s. In CI