Add CSP validation for OpenAI's _meta field requirements in MCPJam

When developing MCP apps for ChatGPT's Apps SDK, OpenAI requires CSP domains to be specified in a special `_meta` field (not the regular `meta` field). Apps will load fine during development and even in unpublished ChatGPT apps, but will be completely blocked by CSP errors once published to a workspace, even internally.

This creates a poor developer experience because the issue only surfaces very late in the development cycle after:
1. Deploying the fix
2. Connecting to the app on ChatGPT
3. Publishing the app to the workspace
4. Testing it out

**Expected `_meta` format:**

```json
{
"uri": "ui://widgets/my_widget.html",
"mimeType": "text/html+skybridge",
"_meta": {
"openai/widgetDescription": "...",
"openai/widgetPrefersBorder": true,
"openai/widgetDomain": "my_widget.localhost",
"openai/widgetCSP": {
"connect_domains": ["http://localhost:8000"],
"resource_domains": ["http://localhost:8000"]
}
}
}
```

**Current workaround:**

Manual testing via: Resources tab → click widget → Read → check response for `_meta` field

**Suggested solution:**

Add validation in MCPJam's App Builder (Strict CSP mode) to check for the presence and correct format of the `_meta` field for OpenAI apps, similar to how asset loading CSP is currently validated.

**Additional context:**

- MCPJam currently validates CSP for loaded assets, but doesn't catch this OpenAI-specific requirement
- FastMCP doesn't natively support the OpenAI `_meta` field, requiring developers to write wrappers
- Related community thread: https://community.openai.com/t/issue-fastmcp-resources-cannot-return-meta-in-read-responses-but-openai-client-expects-it/1368892
- Current MCPJam version catches blocked requests like fonts (`https://cdn.openai.com/common/fonts/katex/KaTeX_AMS-Regular.woff2`), but not the `_meta` field requirement