[Runtime] Disable the default CSP policy

Remove the default CSP policy: script-src 'self'; object-src 'self',
since it will block many tests and applications.