[Proposal] Support web workers (`worker-src`) via `workerDomains` on `McpUiResourceCsp`

Is your feature request related to a problem? Please describe.

MCP apps can load several file types via resourceDomains ( img-src, script-src, style-src, font-src, media-src ), but it cannot load web-workers

Describe the solution you'd like

I'd like to set a new property workerDomains on the McpUiResourceCsp interface , and use this to list permitted domains (or the inlined blob: option) for serving web-worker code.

Describe alternatives you've considered

• We could render our own iframe inside the main iframe
• We avoid using features that use web-workers
• We could add worker-src to the list of resources supported by resourceDomains, but web-workers are complex enough from a security perspective that hosts that don't want to support them should be able to reject this type without impacting the other static resource types.

Start with the McpUiResourceCsp interface in src/spec.types.ts, especially the existing resourceDomains fields and the worker-src CSP behavior described in the issue. Trace where these CSP resource settings are consumed. Done means hosts can independently accept or reject workerDomains, including permitted domains and the inlined blob: option, without changing other resource types.