Fix draw.io/diagrams.net "export" function

[vincentbernat]

Exporting a diagram is done using the "blob:" scheme. This is not allowed by the current CSP. Add it automatically when we have draw.io/diagrams.net integration enabled.

Fix #4710

[ssddanbrown]

Thanks for offering this @vincentbernat, but when looking before I found it hard to understand the full potential security impact of adding the blob scheme to CSP (which is why I haven't added it so far). Where there's a non-understood risk, I'd rather that this be opt in (via adding to ALLOWED_IFRAME_SOURCES) rather than enabled by default.

[ssddanbrown]

I'll go ahead and close this off under the reasoning provided above.