DEV: Add manifest-src to CSP (PR #13319)

Defaults to manifest-src: 'self' and allows plugins/themes to extend it.

GitHub