fix(desktop): enable the content security policy - #4614

Restrict executable content to the packaged application while retaining the relay, media, asset, and Tauri IPC schemes the desktop uses at runtime.

Co-authored-by: Jordan Mecom <jm@squareup.com>
Signed-off-by: Jordan Mecom <jm@squareup.com>

The newly enabled policy broke two shipped features in packaged builds, and
neither `just dev` (loads the Vite devUrl) nor Playwright (`vite preview`)
enforces the CSP, so nothing caught it:

- `script-src 'self'` without `'wasm-unsafe-eval'` blocks WebAssembly
  instantiation. Shiki's default engine is Oniguruma-WASM (inlined, no fetch),
  so every code block silently fell back to plain text; MediaPipe selfie
  segmentation failed the same way.
- The MediaPipe wasm loader is fetched from jsDelivr. Allowlist that origin
  rather than vendoring the 32MB asset set.
- `rewriteRelayUrl` emits `buzz-media://localhost/...` until the loopback proxy
  port resolves, so cold-start media needs the custom scheme (mapped to
  `http://buzz-media.localhost` on Windows) in img/media/connect-src.

Drops the `asset:` sources: `assetProtocol` is not enabled and nothing calls
`convertFileSrc`. `connect-src` keeps blanket cleartext schemes — relay URLs
are user-supplied and plain `ws://` on any host is accepted, so `relayProbe`
would report reachable relays as dead.

Adds csp_tests.rs pinning the non-obvious sources, since the policy is
unenforceable in both local dev and the e2e suite.

Signed-off-by: Eli Foster <efoster@squareup.com>