Resolves the conflict in `studio/backend/main.py` `_csp_header()`. Both
sides widened the Content-Security-Policy for Hugging Face endpoints:
* This branch (9d693b35) extended `img-src` to cover
`https://huggingface.co` and `https://cdn-avatars.huggingface.co`
(so the model picker can render owner avatars) and broadened
`connect-src` to cover `*.huggingface.co`, `cdn-lfs.huggingface.co`,
`cdn-lfs.hf.co`, `hf.co`, and `*.hf.co` (so the picker can resolve
LFS file metadata).
* `main` added `https://datasets-server.huggingface.co` to
`connect-src` for the dataset picker.
Kept both: the new `img-src` and `connect-src` allowlist now includes
the union of every HF origin the frontend touches.
Verified post-merge:
- `pytest studio/backend/tests --deselect test_studio_api.py`:
1119 passed, 46 skipped, 0 failed.
- CSP string in `main.py` parses cleanly and contains all three
additions (`t3.gstatic.com https://huggingface.co`,
`cdn-avatars.huggingface.co`, `datasets-server.huggingface.co`).
6a7dad86d1