This is required because the script security manager which currently owns the
singleton is main-thread only. This change still ties the lifecycle of the
static to that service, but also makes it generally available from any thread.

Differential Revision: https://phabricator.services.mozilla.com/D163035