[BUG] blob: and data: declared in connectDomains/resourceDomains are silently stripped from connect-src and font-src CSP directives

### What happened?

When declaring blob: in connectDomains and data: in resourceDomains via _meta.ui.csp, Claude.ai silently strips them from the rendered iframe CSP. All https:// origins declared alongside them are applied correctly. The same MCP server config works correctly on ChatGPT and Microsoft Copilot.

### What did you expect to happen?

As per the MCP Apps spec, connectDomains maps to connect-src and resourceDomains maps to font-src (among others). **blob:** and **data:** are valid CSP source expressions. They should be passed through to the corresponding directives.

### Steps to reproduce

Create an MCP server that serves a UI resource (text/html;profile=mcp-app) with the following _meta.ui.csp declaration:

```
{
"_meta": {
"ui": {
"csp": {
"connectDomains": [
"blob:",
"data:",
"https://example.com"
],
"resourceDomains": [
"blob:",
"data:",
"https://example.com"
]
}
}
}
}
```
Connect the MCP server to Claude Desktop and invoke a tool that returns the UI resource.

Open browser DevTools on the rendered widget iframe.

Inspect the Content-Security-Policy header applied to the iframe document.

Expected Result

connect-src 'self' blob: data: https://example.com
font-src 'self' blob: data: https://example.com
Actual Result

connect-src 'self' https://example.com
font-src 'self' https://example.com
blob: and data: are silently stripped from connect-src and font-src. All https:// origins are applied correctly.

### Area

MCP Connector (adding/managing servers)

### MCP Server (if applicable)

_No response_

### Error messages or logs

```shell

```

### Additional context

The stripping behavior is undocumented — neither the [McpUiResourceCsp interface docs](https://apps.extensions.modelcontextprotocol.io/api/interfaces/app.McpUiResourceCsp.html) nor the [MCP Apps spec](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/2026-01-26/apps.mdx) mention that non-HTTPS scheme values will be dropped.

Related issue: https://github.com/anthropics/claude-ai-mcp/issues/40