Add "blob:" "data:" to the img-src CSP

We get warnings for them from pdfjs, while everything seems to work without
it better allow them.