Document CSP needed for `cubing.js`

[lgarron]

People may want to use cdn.cubing.net with a CSP policy on their site. We should document what CSP directives / values are needed for full functionality.

We should also reduce this over time, e.g. once a trampoline is no longer needed for web workers.