MCP app webview CSP missing worker-src - blocks blob-based Web Workers (e.g. MapLibre)

Does this issue occur when all extensions are disabled?: No — this is not reproducible with extensions disabled because GitHub Copilot Chat (the extension providing the MCP webview host) is itself required to reproduce it. The bug is in VS Code's own MCP app webview CSP construction, which only runs when Copilot Chat's MCP Apps feature is active.

- VS Code Version: 1.133.0 (darwin arm64)
- OS Version: macOS (darwin arm64)

### Steps to Reproduce:

1. Connect an MCP server whose UI resource renders a map using MapLibre GL JS (e.g. CARTO's MCP server, over HTTP, with Copilot Chat 0.61.0 as the MCP Apps host).
2. Ask the agent to show data on a map (a tool call that returns an MCP UI resource with a MapLibre-based map widget).
3. Observe: the data layer renders, but the basemap never paints — the map area stays blank behind the data. No error is surfaced in the chat UI.
4. Open the webview's DevTools console (Help > Toggle Developer Tools) and see:
```
Creating a worker from 'blob:vscode-webview://…' violates the following Content
Security Policy directive: "script-src 'self' 'unsafe-inline' ".
Note that 'worker-src' was not explicitly set, so 'script-src' is used as a
fallback. The action has been blocked.
```

### Root cause
The MCP app webview's injected Content-Security-Policy has no `worker-src` directive. Per spec, when `worker-src` is unset the browser falls back to `script-src`, which has no `blob:` scheme - so any MCP app that spawns a Web Worker from a `blob:` URL (e.g. MapLibre GL JS's tile-parsing workers) is blocked.

Confirmed directly in source: `src/vs/workbench/contrib/chat/browser/widget/chatContentParts/toolInvocationParts/chatMcpAppModel.ts`, in `_injectPreamble`. The full directive list built there is `default-src`, `script-src`, `style-src`, `connect-src`, `img-src`, `font-src`, `media-src`, `frame-src`, `object-src`, `base-uri` - `worker-src` is absent.

### Suggested fix
Add `worker-src 'self' blob:;` to the CSP content string, alongside the existing directives.

### Related
- This is not fixable from the MCP resource side, and does not require an MCP Apps spec change - the reference host implementation (`examples/basic-host/serve.ts` in `modelcontextprotocol/ext-apps`) already sets `worker-src 'self' blob:` unconditionally.
- Separately, `modelcontextprotocol/ext-apps#566` proposes a `workerDomains` field for resource-level control - that's an independent, optional enhancement, not a prerequisite for this fix.