To work 100% this needs "style-src: unsafe-inline" in the CSP, without
this the popup on hover does not show the series color - which in our
case is better than using the CSP.

also drop obsolete appcache, browsers no longer use this.

reference: https://github.com/apache/echarts/issues/16610