fix(security): update script-src directive to include 'blob:'

.gitignore

@@ -49,4 +49,5 @@ libreoffice-wasm-package
 bentopdf-*.tgz
 
 # test 
-dist-test
+dist-test
+test

scripts/generate-security-headers.mjs

@@ -55,7 +55,7 @@ const fontOrigins = uniq([ocrFontOrigin].filter(Boolean));
 
 const directives = [
   `default-src 'self'`,
-  `script-src 'self' 'wasm-unsafe-eval' 'unsafe-eval' ${scriptOrigins.join(' ')}`.trim(),
+  `script-src 'self' 'wasm-unsafe-eval' 'unsafe-eval' blob: ${scriptOrigins.join(' ')}`.trim(),
   `worker-src 'self' blob:`,
   `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com`,
   `img-src 'self' data: blob: https:`,