fix(security): allow HTTPS stylesheets in output iframe CSP

[rgbkrk]

Summary

• Adds https: to the style-src CSP directive in the isolated output iframe
• Unblocks folium and other libraries that load CSS from CDNs (jsdelivr, cdnjs, etc.)
• Consistent with script-src which already allows https:
• Iframes remain sandboxed without allow-same-origin — no security posture change

Addresses #1494

Test plan

• Folium map renders correctly (tiles + styled controls)
• Existing outputs still render (Vega, Plotly, matplotlib, widgets)
• No allow-same-origin in sandbox (CI test)

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
TestMultiClientSync/test_async_shared_kernel_execution	View Logs
TestTerminalEmulation/test_progress_bar_simulation	View Logs