Let blob: pass CSP

In order to allow showing a preview of an uploaded image, blob: URI protocol needs to be allowed by CSP. An example:

Without this MR:

The blob URLs look like blob:https://example.tld/e1e9d0fe-f12a-4d58-889b-0d0828594e40 and are created using URL.createObjectURL(file)

Example JS:

const [file] = e.target.files;
const url = file ? URL.createObjectURL(file);

console.log(url); // blob:https://example.tld/e1e9d0fe-f12a-4d58-889b-0d0828594e40

This MR just lets blob: URIs be accepted by CSP.