CSP worker-src doesn't match where workers are loaded from

### Steps to reproduce

For the develop deployment, our CSP in the meta tag has a worker-src of `'self' blob: https://element-web-develop.element.io;`. This would suggest that it ought to be able to load workers from https://element-web-develop.element.io, however when https://github.com/vector-im/element-web/issues/26698 happened, worker loads 301ed to a location on the above origin and then failed to load.

It may be that redirects are simply unsupported for worker loading under CSPs, but if so are we loading workers from that origin at all? If not, we should remove it.

### Outcome

#### What did you expect?

#### What happened instead?

### Operating system

_No response_

### Browser information

_No response_

### URL for webapp

_No response_

### Application version

_No response_

### Homeserver

_No response_

### Will you send logs?

No

Start by locating the develop deployment's CSP meta tag and the worker-loading entry points. Check whether worker requests redirect and whether workers are actually loaded from the listed origin; done means the policy matches the real worker sources, or the unused origin is removed.

Written by the indexing model from the issue text.