Live sample CSP should allow blob: URLs created on this domain?

Not sure if this is the correct place to make this issue, but I can't find a better place to. In content, we have a few live samples that use createObjectURL for video source. It looks like while blob: URLs are allowed for images, they are forbidden for videos because we don't have media-src. See for example: https://github.com/mdn/content/pull/40317, which added the comment <!-- TODO: re-enable when blob: URLs are allowed by CSP settings --> to the example on https://developer.mozilla.org/en-US/docs/Web/API/MediaStream_Recording_API#examples. We also have this problem on https://developer.mozilla.org/en-US/docs/Web/API/MediaStream_Recording_API/Recording_a_media_element, which might be the cause of https://github.com/mdn/content/issues/12673. In short, whenever you do videoElement.src = URL.createObjectURL(blob), you get Refused to load media from 'blob:https://927dd9ce-2b3b-4933-b54b-09a2be8635a2.mdnplay.dev/c92f3f3a-b9fb-4a01-ba3a-27e88fbf73df' because it violates the following Content Security Policy directive: "default-src 'self' https:". Note that 'media-src' was not explicitly set, so 'default-src' is used as a fallback..

As I said in https://github.com/mdn/content/pull/40317, I'm not sure if allowing all blob: URLs is a good practice, but at least we should allow blob: URLs created in the same domain as the live sample runner.

Start with the live sample runner's Content Security Policy handling and reproduce the failure described for MediaStream Recording API live samples. Review the examples linked in the issue, including Recording a media element, and verify that same-domain blob media URLs work without broadly allowing unrelated blob URLs.