PNG dashboard card download doesn't do anything in MacOS Safari

[rognstad]

Describe the bug

When viewing a dashboard card with a visualization, attempting to download it as a PNG does nothing (no file downloaded, no prompt to allow downloads) in MacOS Safari

To Reproduce

1. Using Safari and MacOS and full app embedding, go to a dashboard that includes a card with a visualization
2. Attempt to download the card as JSON, note that it works
3. Attempt to download the card as PNG, note that nothing happens

Expected behavior

It should download a PNG

Logs

Console in the browser shows:

[Error] Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' does not appear in the style-src directive of the Content Security Policy. (11-account-snapshot, line 1)
[Debug] #3 – "211ms" – "Document cloned, element located at 592,223 with size 1168x197 using computed rendering" (vendor.a42b74c52173b8154879.js, line 97)
[Debug] #3 – "211ms" – "Starting DOM parsing" (vendor.a42b74c52173b8154879.js, line 97)
[Debug] #3 – "243ms" – "Added image data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20data-testid%3D%22pie-chart%22%20width%3D%22159p…" (vendor.a42b74c52173b8154879.js, line 97)
"Added image data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20data-testid%3D%22pie-chart%22%20width%3D%22159px%22%20height%3D%22159px%22%20style%3D%22max-width%3A%20550px%3B%20transition%3A%20all%3B%20--color-brand-alpha-88%3A%20rgba(0%2"
[Debug] #3 – "246ms" – "Starting renderer for element at 592,223 with size 1168x197" (vendor.a42b74c52173b8154879.js, line 97)
[Debug] #3 – "247ms" – "Canvas renderer initialized (1168x197) with scale 2" (vendor.a42b74c52173b8154879.js, line 97)
[Debug] #3 – "262ms" – "Finished rendering" (vendor.a42b74c52173b8154879.js, line 97)
[Error] Refused to load data:image/octet-stream;base64,iVBORw0KGgoAAAANSUhEUgAACSAAAAGKCAYAAAAWx31NAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAJIKADAAQAAAABAAABigAAAAClTi6MAABAAElEQVR4AezdB3wb15Xo4UMS7F2iepdlyZZlW+6We6+JnTjFiZ22cTblbcpmX7Zls/s2m83blE3d1BfbqS5JbMe9yVUusprVexclUYW9o797RgY4A4AkCAIkhvhf/2BMuXPnzjcDEMIcnJsXNkUoCCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggEAKAvkpbMMmCCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggIAlQAASFwICCCCAAAIIIIAAAggggAACCCCA...pANAUBAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQIECBAgACBUgUEkErtvLoJECBAgAABAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQI1CAggFQDoikIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQIlCoggFRq59VNgAABAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQIECBAoAYBAaQaEE1BgAABAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQIECBAoFQBAaRSO69uAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAjUICCDVgGgKAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAqUKCCCV2nl1EyBAgAABAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQIEKhB4P8AEeY6X3AIh3YAAAAASUVORK5CYII= because it does not appear in the frame-src directive of the Content Security Policy.```

### Information about your Metabase installation

```JSON
{
  "browser-info": {
    "language": "en-AU",
    "platform": "MacIntel",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15",
    "vendor": "Apple Computer, Inc."
  },
  "system-info": {
    "file.encoding": "UTF-8",
    "java.runtime.name": "OpenJDK Runtime Environment",
    "java.runtime.version": "11.0.22+7-post-Ubuntu-0ubuntu220.04.1",
    "java.vendor": "Ubuntu",
    "java.vendor.url": "https://ubuntu.com/",
    "java.version": "11.0.22",
    "java.vm.name": "OpenJDK 64-Bit Server VM",
    "java.vm.version": "11.0.22+7-post-Ubuntu-0ubuntu220.04.1",
    "os.name": "Linux",
    "os.version": "5.15.0-1052-aws",
    "user.language": "en",
    "user.timezone": "Etc/UTC"
  },
  "metabase-info": {
    "databases": [
      "bigquery-cloud-sdk",
      "mysql",
      "postgres"
    ],
    "hosting-env": "unknown",
    "application-database": "postgres",
    "application-database-details": {
      "database": {
        "name": "PostgreSQL",
        "version": "13.13"
      },
      "jdbc-driver": {
        "name": "PostgreSQL JDBC Driver",
        "version": "42.6.0"
      }
    },
    "run-mode": "prod",
    "version": {
      "date": "2024-03-04",
      "tag": "v1.48.8",
      "hash": "a900c85"
    },
    "settings": {
      "report-timezone": null
    }
  }
}

Severity

annoying

Additional context

No response