Add csp for worker-src

Address ZAP finding:

The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined: worker-src 

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/worker-src#syntax

https://web.dev/articles/csp#policy_applies_to_a_wide_variety_of_resources https://workshop.cloud.gov/cloud-gov/customer-services/cg-ui/-/blob/0c382a6f8b5009ba37130f779d8148eb12b6dc04/src/middlewares/withCSP.ts#L9

prob set worker-src to self?