DEV: Remove blob: workers from CSP (PR #10440)

Ace editor is reconfigured to load workers directly from the JS URL. For this to work when an app cdn is in place, we need to add the Access-Control-Allow-Origin header to /javascripts/ routes

GitHub