csp: allow data: URLs in worker-src for web-forms

[alxndrsn]

Closes #1775

What has been done to verify that this works as intended?

Added a test.

Why is this the best possible solution? Were any other approaches considered?

Maybe not a great solution - it seems unfortunate to need to loosen the CSP for feature detection.

How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?

No effect.

Does this change require updates to documentation? If so, please file an issue here and include the link below.

No.

Before submitting this PR, please make sure you have:

• branched off and targeted the next branch OR only changed documentation/infrastructure (master is stable and used in production)
• verified that any code or assets from external sources are properly credited in comments or that everything is internally sourced

[lognaturel]

Do you remember what we have worker-src blob: for? If we already need to have that, adding data: doesn't seem worse but ideally we wouldn't need either. CC @garethbowen in case you have other ideas!

[alxndrsn]

Do you remember what we have worker-src blob: for?

It was originally introduced for OpenLayers maps in:

• nginx/csp/frontend: fix: OpenLayers (map) worker-src #1530

It was then duplicated when enketo & web-forms CSPs were split in:

• Add CSP headers specifically for Web Forms #1526

If we already need to have that, adding data: doesn't seem worse but ideally we wouldn't need either.

I think technically data: is less safe than blob:, as a data URL (data:) can be injected with only HTML or DOM manipulation, whereas an object URL (blob:) requires script injection.

Ideally we'd avoid both; adding blob: when data: is already listed should not be a significant increase in risk.

Ref:

• https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/data
• https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/blob
• 打包部署后页面空白 openlayers/openlayers#16046