vector/index.html: Allow fetching blob and data urls from script

[SuperKenVery]

For matrix-org/matrix-react-sdk#10851

Checklist

• Tests written for new code (and old code if feasible)
• Linter and other CI checks pass
• Sign-off given on the changes (see CONTRIBUTING.md)

Works with this matrix-react-sdk pr

---

This PR currently has none of the required changelog labels.

A reviewer can add one of: T-Deprecation, T-Enhancement, T-Defect, T-Task to indicate what type of change this is, or add Type: [enhancement/defect/task] to the description and I'll add them for you.

[github-actions]

Thanks for opening this pull request, unfortunately we do not accept contributions from the main branch of your fork, please re-open once you switch to an alternative branch for everyone's sanity. See https://github.com/matrix-org/matrix-js-sdk/blob/develop/CONTRIBUTING.md

[t3chguy]

This likely has security implications - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src - it might create an XSS vulnerability around anchors pointing at executable blobs

[SuperKenVery]

But this is required to retrieve the data from script... No chance to do this?

And, I can't understand your XSS vulnerability and I can't find anything about this in the link provided :( My poor knowledge about web 🤣