[security] Allow blobs of javascript (legacy scripts in SS)

[StephenHulme]

Hopefully addresses verbose warnings in CI tests:

http://127.0.0.1:45849/studies 13 [Report Only] Refused to load the script 'http://127.0.0.1:45849/
vite-test/assets/_commonjsHelpers-Cpj98o6Y.js' because it violates the following Content 
Security Policy directive: "script-src blob: 'nonce-88c8519e1e6ee418de7f390c8d346967'". 
Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

CI test run

Also visible from the browser in the JS console.

Changes proposed in this pull request

• Add blob to policy script as suggested

Instructions for Reviewers

[All PRs] - Confirm PR template filled
[Feature Branches] - Review code
[Production Merges to main]
    - Check story numbers included
    - Check for debug code
    - Check version

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.28%. Comparing base (03dff92) to head (e6588cc).
⚠️ Report is 3 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #5713      +/-   ##
===========================================
- Coverage    87.30%   87.28%   -0.02%     
===========================================
  Files         1467     1467              
  Lines        33167    33167              
  Branches      3496     3496              
===========================================
- Hits         28955    28949       -6     
- Misses        4191     4197       +6     
  Partials        21       21              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.