Tighten CSP scheme handling for Google Fonts

Browsers refused to load Noto Sans KR woff2 files served from
fonts.gstatic.com because the CSP listed the host without a scheme:

  font-src fonts.gstatic.com *.gstatic.com

Some browsers interpret the unprefixed host as same-scheme as the page
(http when the wiki is behind plain HTTP), but the actual font is
delivered over https — so the request was blocked. Adding https://
explicitly + data: (for inline icon fonts that some KaTeX/highlight
themes embed) makes the policy work the same way regardless of how the
site is served. Also normalized style-src to use scheme-prefixed hosts
for cdn.jsdelivr.net and fonts.googleapis.com for consistency.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jiunbae

src/server.ts

@@ -732,7 +732,7 @@ export function startServer(root: string, port: number, host: string): void {
 
       if (await staticFile.exists()) {
         const isHtml = pathname.endsWith(".html");
-        const cspValue = "default-src 'self'; script-src 'self' 'unsafe-inline' cdn.jsdelivr.net d3js.org static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' cdn.jsdelivr.net fonts.googleapis.com; font-src fonts.gstatic.com *.gstatic.com; img-src * data:; connect-src 'self' cloudflareinsights.com";
+        const cspValue = "default-src 'self'; script-src 'self' 'unsafe-inline' cdn.jsdelivr.net d3js.org static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src https://fonts.gstatic.com https://*.gstatic.com data:; img-src * data:; connect-src 'self' cloudflareinsights.com";
         if (isHtml) {
           const queryToken = url.searchParams.get("token");
           const isAuthed = isAuthenticated(req, url);