Increase CSP level to match tauri

## Feature Request

https://tauri.app/v1/references/security#secure-content-loading

I'm not clear if we do this already or not, but we should definitely set up stricter asset loading CSP. While it may be convenient to load scripts from the arbitrary internet, we don't do a great job of educating developers that they *shouldn't* for native apps.

Even though the JS is running in a sandbox, that doesn't preclude any scripts from attempting to load resources from the system.