I have JIRA issue created

• branch and/or PR name(s) includes JIRA ID
• issue has "Fix version" assigned
• issue "Status" is set to "In review"
• PR labels are selected
• FLP integration tests were ran successful

Changes:

• Update Content-Security-Policy to permit blob: URLs for images only.

The changes allow for Blob-based images to be previewed or downloaded.
Other Blob types such as script-src are not permitted, mainly to prevent unwanted code execution via:

const blob = new Blob(['console.log(\'executed\')'], { type: 'application/javascript' });

By default, Helmet's CSP middleware allows "'self'", "data:" in img-src, see: https://github.com/helmetjs/helmet/blob/dd6e18f735d61248f654df3960da80db7fb2120a/middlewares/content-security-policy/index.ts#L63.

Do note that blob: URLs are entirely local to the browser. When you create a blob URL using URL.createObjectURL(blob), the browser generates an internal reference to an in-memory Blob or MediaSource object. It cannot be used to fetch resources from another website. For more information, please see the documentation: https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/blob