Thanks to @sfdcfox and @AndrewFawcett we were able to figure an elegant way on how to create a dynamic RemoteSiteSetting for the actual salesforce org in order to use MetadataAPI, ToolingAPI and so on: Access MetadataAPI via JavaScript
Now we did bad earlier and included a longer list of Remote Sites into the managed package... :-(
Is there any chance to get rid of RemoteSiteSetting again? The package is in the wild and in use by a lot of users. So to uninstall it everywhere and let support revert it back to beta seems not to be realistic.