Fix the CSP: allow the runtime blob module (gabrielkpo/alias fix/demo-csp-blob)

index.html

@@ -4,8 +4,9 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <!-- The page talks to two hosts only: Hugging Face for the model files and jsDelivr for the
-       ONNX runtime. The text is never part of a request: nothing could send it anywhere else. -->
-  <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' https://cdn.jsdelivr.net 'wasm-unsafe-eval'; connect-src https://huggingface.co https://*.huggingface.co https://*.hf.co https://cdn.jsdelivr.net; worker-src 'self' blob: https://cdn.jsdelivr.net; style-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'">
+       ONNX runtime. The text is never part of a request: nothing could send it anywhere else.
+       blob: in script-src: the runtime imports its WebAssembly glue module from a blob URL. -->
+  <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' blob: https://cdn.jsdelivr.net 'wasm-unsafe-eval'; connect-src https://huggingface.co https://*.huggingface.co https://*.hf.co https://cdn.jsdelivr.net; worker-src 'self' blob: https://cdn.jsdelivr.net; style-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'">
   <title>Alias</title>
   <link rel="stylesheet" href="style.css">
   <script type="module" src="app.js"></script>