Revert "DEV: Disable ACE editor worker blobs"

This reverts commit d5463d2a4d.

With S3 assets, CORS prevents loading worker assets directly.

spec/lib/content_security_policy_spec.rb

@@ -33,9 +33,11 @@ describe ContentSecurityPolicy do
   end
 
   describe 'worker-src' do
-    it 'always has script srcs' do
+    it 'has expected values' do
       worker_srcs = parse(policy)['worker-src']
       expect(worker_srcs).to eq(%w[
+        'self'
+        blob:
         http://test.localhost/assets/
         http://test.localhost/brotli_asset/
         http://test.localhost/javascripts/