Worker created from inline text and loaded via blob URI should not run with policy default-src *