Scope CSS imports

Created by: Timer

First seen in #2794 (closed). We need to consider this breaking.

Basically, you can require CSS out of src/ which probably shouldn't be allowed.