Add option not to use a blob: URL for the worker source

[ClearlyClaire]

No description provided.

[nolanlawson]

Thanks for this PR; I ran into this issue too due to CSP. :)

One thing I wonder: why default to using a Blob URL at all? If the worker can call importScripts() on a URL, then it should be able to load that URL directly in a worker as well. I also can't think of an environment where one would want CSP to allow blob:, but disallow self (since one is inherently more insecure than the other).

[ClearlyClaire]

As far as I understand, having a Blob URL for workers make them inherit from the document's CSP whereas using an URL requires you to set an appropriate CSP when serving the worker JS file.

This might be the reason for the Blob URL, I am not sure.

[nolanlawson]

It's still possible to have CSP that disallows blob: URLs (in fact, this was my setup). I'd argue it's much more common in fact for CSP to allow self but not blob:, hence why I find this default a bit odd. But as long as it can be toggled, great! :)

[ClearlyClaire]

Yeah, but the thing is, when you don't use blob:, you have to make sure the worker script itself is served with a CSP (otherwise as I understand, it will be unrestricted), which is error-prone, especially if the script is loaded from a CDN you don't control