Breaking out of restricted mode: XSS to RCE in Visual Studio Code