Fix giscus origin validation in giscus.json

[kevinjqliu]

Fixes #173 (comment)
Followup to #172

What

Change giscus.json origins from https://datafusion.apache.org/blog to https://datafusion.apache.org.

Why

Giscus checks the embedding page's window.origin against the origins list using strict equality:

string === window.origin

window.origin is always protocol + host + port with no path. So window.origin on any page under datafusion.apache.org is https://datafusion.apache.org, which never matched https://datafusion.apache.org/blog.

When the origin check fails, giscus redirects its iframe to https://github.com/orgs/giscus/discussions/1298, which is then blocked by the site's CSP frame-src directive (since github.com isn't allowed), producing:

Framing 'https://github.com/' violates the following Content Security Policy directive: "frame-src ..."

References

• Giscus origins documentation
• CSP fix for giscus.app: Add giscus.app to CSP via .htaccess #173

[alamb]

Thanks @kevinjqliu