Remove localhost attribute in the `img-src` CSP directive — radicle-desktop

By restricting img-src in our CSP, we weren’t allowing images from e.g. https://github.com like CI badges to display.

We can eventually look at it again in the future but I think users will try to embed pictures from lots of places in their comments, descriptions, etc.

       "csp": {
         "default-src": "'self'",
         "connect-src": "ipc: http://ipc.localhost",
         "img-src": "'self' asset: http://asset.localhost blob: data:",
         "img-src": "'self' blob: data: https:",
         "style-src": "'unsafe-inline' 'self'"
       },
       "pattern": {