CSP: include worker_src

`worker_src` fallbacks to `script_src`, but #6611 made `script_src` too
restrict to include the service worker.

lib/content_security_policy.rb

@@ -37,6 +37,7 @@ class ContentSecurityPolicy
     @request = request
     @directives = {
       script_src: script_src,
+      worker_src: [:self],
     }
 
     @directives[:report_uri] = path('/csp_reports') if SiteSetting.content_security_policy_collect_reports