Add unsafe-inline and blob: sources to Content Security Policy

[rbreslow]

Overview

Add unsafe-inline and blob: sources to Content Security Policy.

Fixes #4

Testing Instructions

See deploy preview in PR checks.

[rbreslow]

[Error] TypeError: undefined is not a function (near '...}).finally(function () {...')
	warpImage (main.js:218)
	dispatch (jquery-3.3.1.min.js:2:41778)
[Error] Unhandled Promise Rejection: Error: Can't find variable: File
	(anonymous function) (loam.min.js:1:1402)
	promiseReactionJob

This looks unrelated to CSP stuff. Will take a look tomorrow.

[ddohler]

That's a Safari-specific bug in Loam: azavea/loam#20 . It was known at deployment time and we made a decision to ignore it, so it's not critical to fix right now.

[tnation14]

👍 Nice work. In testing this, I also noticed some blocked requests for data: URIs coming from Leaflet. I think you should add data: to the CSP as well.