Fix CSP connect-src to allow all local assets — radicle-desktop

The previous entry hardcoded a Vite-generated content-hash filename (onig-CwjCXqnP.wasm), which breaks whenever the file’s hash changes between builds. Replacing it with ‘self’ covers all same-origin assets regardless of filename.

👉 Workflow runs 👉 Branch on GitHub

     "security": {
       "csp": {
         "default-src": "'self'",
         "connect-src": "ipc: http://ipc.localhost https://files.radicle.xyz tauri://localhost/assets/onig-CwjCXqnP.wasm",
         "connect-src": "'self' ipc: http://ipc.localhost https://files.radicle.xyz",
         "img-src": "'self' blob: data: https:",
         "script-src": "'wasm-unsafe-eval'",
         "style-src": "'unsafe-inline' 'self'"