chore: add cloudflare to script-src CSP

Author: FRSgit

packages/index/src/index.html

@@ -15,7 +15,7 @@
         <meta name="viewport" content="width=device-width, initial-scale=1" />
         <meta
             http-equiv="Content-Security-Policy"
-            content="default-src; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://www.google.com https://www.gstatic.com; script-src-attr; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' data:; font-src https://fonts.gstatic.com; connect-src 'self' https://script.google.com https://script.googleusercontent.com https://www.google.com/recaptcha/; media-src; object-src; child-src; frame-src 'self' https://www.google.com; worker-src 'self'; form-action https://script.google.com; manifest-src 'self'; upgrade-insecure-requests; block-all-mixed-content"
+            content="default-src; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://www.google.com https://www.gstatic.com https://static.cloudflareinsights.com; script-src-attr; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' data:; font-src https://fonts.gstatic.com; connect-src 'self' https://script.google.com https://script.googleusercontent.com https://www.google.com/recaptcha/; media-src; object-src; child-src; frame-src 'self' https://www.google.com; worker-src 'self'; form-action https://script.google.com; manifest-src 'self'; upgrade-insecure-requests; block-all-mixed-content"
         />
 
         <link