docs: add cdn.jsdelivr.net to connect-src

[timothymcmackin]

We're getting CSP errors for the Biel script on https://cdn.jsdelivr.net getting blocked:

This adds that domain to the CSP settings. It fixed the issue on docs.tezos.com: https://gitlab.com/tezos/docs/-/merge_requests/109

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.16%. Comparing base (8515569) to head (fbf7f48).

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8515569...fbf7f48. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[huancheng-trili]

How do I observe this error? I don't see it in prod right now.

[timothymcmackin]

How do I observe this error? I don't see it in prod right now.

I see it in prod on Chrome on MacOS when I press option+command+i to open the console:

[huancheng-trili]

Yes I did that too, but I don't see the errors in dev tools. It shows instead that GET https://cdn.jsdelivr.net/npm/biel-search@latest/dist/biel-search/biel-search.css returns 200. What if you disable cache and refresh the page?

[timothymcmackin]

Yes I did that too, but I don't see the errors in dev tools. It shows instead that GET https://cdn.jsdelivr.net/npm/biel-search@latest/dist/biel-search/biel-search.css returns 200. What if you disable cache and refresh the page?

Strange. I still see it in Chrome after deleting site data., hard-refreshing, and opening in an incognito window.

[huancheng-trili]

Indeed. I do see a different error with docs.tezos.com though.

Refused to load the script 'https://us-assets.i.posthog.com/static/array.js' because it violates the following Content Security Policy directive: "script-src https://*.googletagmanager.com https://cdn.jsdelivr.net 'self' 'unsafe-inline'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.