App user QR code violates CSP directive

[matthew-white]

Problem description

When I view an app user QR code in Frontend, I see an error in the browser console in Chrome:

[Report Only] Refused to load the image 'data:image/gif;base64,...' because it violates the following Content Security Policy directive: "img-src *". Note that '*' matches only URLs with network schemes ('http', 'https', 'ws', 'wss'), or URLs whose scheme matches `self`'s scheme. The scheme 'data:' must be added explicitly.

URL of the page

https://staging.getodk.cloud/#/projects/85/app-users

Steps to reproduce the problem

1. Navigate to the URL above.
2. Open the browser console.
3. Click "See code".

Central version shown in version.txt

versions:
f0b2a90bce34fc13b0df4affd8b3158d57bcf904 (v2023.5.1-5-gf0b2a90)
+2bb17a501416814bbd987ddc953abc5b0c40c58a client (v2023.5.0-43-g2bb17a50)
+267e0ad7806057fc82894f58bea680627f1de5cd server (v2023.5.0-49-g267e0ad7)