FIX: Set CSP base-uri to 'self' (PR #13654)

This fixes an issue where selecting text in a post results in Javascript console errors like this one:

This happens because when parsing the selected text (to use when quoting or sharing) we use jQuery.parseHTML which creates a temporary document and sets a base href for it so URLs in the parsed HTML are correct.

In the long run, we should fix this by avoiding jQuery when parsing HTML, but for now, we can switch to setting CSP to 'self', which is still safe.