Default Content Security Policy should whitelist blob scheme

According to latest CSP specifications the '*' source wildcard only applies to network schemes (ftp and http(s)) thus not including other schemes like blob: or data: which cause issues, i.e. with PDF including embedded images viewed with pdf.js.

Users should still be able to override our default CSP contribution (which is recommended anyway) and use:

<header name="Content-Security-Policy">default-src * blob:; script-src 'unsafe-inline' 'unsafe-eval' data: *; style-src 'unsafe-inline' *; font-src data: *</header>