Update content security policy (#1251)

add YouTube

netlify.toml

@@ -12,7 +12,7 @@
     # Activates the browser's built-in cross-site scripting (XSS) filter and blocks responses if an attack is detected.
     X-XSS-Protection = "1; mode=block"
     # Ensures that only trusted content is executed and styled.
-    Content-Security-Policy = "default-src 'self'; script-src 'self' 'blob:' https://cardano.org https://developers.cardano.org https://www.googletagmanager.com; img-src 'self' https://cardano.org https://developers.cardano.org data:; style-src 'self' 'unsafe-inline'; connect-src 'self' https://*.algolianet.com;"
+    Content-Security-Policy = "default-src 'self'; script-src 'self' 'blob:' https://cardano.org https://developers.cardano.org https://www.googletagmanager.com; img-src 'self' https://cardano.org https://developers.cardano.org data: https://*.ytimg.com; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube.com; media-src 'self' https://www.youtube.com; connect-src 'self' https://*.algolianet.com;"
     # Enforces secure connections via HTTPS, protecting against certain types of man-in-the-middle attacks.
     Strict-Transport-Security = "max-age=63072000; includeSubDomains; preload"
     # Controls information provided as the HTTP Referer header when navigating from your site, enhancing privacy and security.