fix(web-app-bluesky/csp): allow inline script-src-elem and *.workers.bsky.app

The bluesky social-app bootstraps via an inline script tag and pulls
runtime config from `app-config.workers.bsky.app` and live events from
`live-events.workers.bsky.app`. Without these CSP relaxations the page
loads under variants that disable the css/cdn injectors (variant 1+),
sys-ctl-hlth-csp reports `[CSP DOM] Blocked URI: inline` on
script-src-elem and `Blocked URI: https://*.workers.bsky.app/config` on
connect-src, and the final-run service aborts the deploy.

Verified in-container by hand-patching the rendered nginx vhost,
reloading nginx, and re-running hlth-csp: web.bluesky.infinito.example
reports `No CSP or network blocks detected`.

roles/web-app-bluesky/meta/server.yml

@@ -9,6 +9,9 @@ domains:
     api: api.bluesky.{{ DOMAIN_PRIMARY }}
     view: view.bluesky.{{ DOMAIN_PRIMARY }}
 csp:
+  flags:
+    script-src-elem:
+      unsafe-inline: true
   whitelist:
     connect-src:
       - "{{ lookup('config', 'web-app-bluesky', 'server.domains.canonical.api') }}"
@@ -17,6 +20,7 @@ csp:
       - https://api.bsky.app
       - https://public.api.bsky.app
       - https://events.bsky.app
+      - https://*.workers.bsky.app # nocheck: url
       - https://statsigapi.net # nocheck: url
       - https://ip.bsky.app # nocheck: url
       - https://video.bsky.app