port test for script-src 1.9 from php tests

CSP test for script-src 1-9 - script running from blobs should not be allowed unless blob: is a whitelisted source for script-src