Add 'self'

Editor assessment

The subject states the remedy in three characters of substance: 'self' is added to the CSP, with a meaningful csp scope. For anyone who has debugged a blocked same-origin request, the defect (the policy omitted the self source) and its symptom are immediately clear, so no body is required. The fix type is right, no footers appear beyond a co-authored-by trailer, and hygiene is clean, with the directive quoted exactly. A tiny message that fully communicates a security-policy correction and its effect.