Files: CSP fixes

- Fixes an undefined variable in core/js/config.php
- Fixes an undefined variable in the file list 
   - Uses the HTML5 data attribute instead of an additional (not cacheable) file