fix(server): allow WASM loading in CSP for ghostty-web terminal

[wangzexi]

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Potential duplicate found:

• PR fix(app): load ghostty wasm via asset url #9186: "fix(app): load ghostty wasm via asset url" - fix(app): load ghostty wasm via asset url #9186

Why it might be related: Both PRs appear to be addressing WASM loading for the ghostty-web terminal, with PR #9186 focusing on loading the WASM asset via a specific URL and PR #9451 focusing on CSP (Content-Security-Policy) modifications to allow WASM loading. These could be related changes or part of the same feature work.

[wangzexi]

#7578