[Content Security Policy] Restrict `blob:` in `connect-src`

Feature Request

Today, we require this directive: connect-src blob:.

This is because botframework-directlinejs use blob URL to retrieve ArrayBuffer for uploading attachments. The code is at https://github.com/microsoft/BotFramework-DirectLineJS/blob/master/src/directLine.ts#L807.

To-do

To remove this directive, we need to modify botframework-directlinejs to use ArrayBuffer or Blob to upload attachments.

Also today, since we are using URL.createObjectURL, we don't have a reliable way to revoke the URL. Moving to ArrayBuffer or Blob will help.

[Enhancement]

从 src/directLine.ts 约第 807 行开始，检查 botframework-directlinejs 如何获取附件数据并创建 blob URL。当附件上传不再需要在 connect-src 中使用 blob:，并且对象 URL 可以可靠地撤销时，这项工作就完成了；该 issue 未指定测试文件或测试入口点。