Allow blob: protocol

[purplesyringa]

Fixes #2165

[ValdikSS]

I believe blob: should not be in quotes.

headers["Content-Security-Policy"] = "default-src 'none'; script-src 'nonce-{0}'; img-src 'self' blob:; style-src 'self' 'unsafe-inline' blob:; connect-src *; frame-src 'self' blob:".format(script_nonce)

That way it works in Firefox and Chrome.
This modification should be reviewed by a web security specialist since it may introduce unwanted functionality or a security vulnerability.

[purplesyringa]

Fixed quotes.

As for me, I don't see any possible security issues here: it's blob after all.