Add worker-src policy directive

Changes proposed in this pull request:

• defines worker-src directive so that it is not an implied wildcard
• addresses #644 (closed)

Submitter checklist

• [ x ] Added logging is not capturing sensitive data and is set to an appropriate level (DEBUG vs INFO etc)
• [ ] Updated relevant documentation (README, ADRs, explainers, diagrams)

Security considerations

• Addresses ZAP findings