add a default `media-src`

`media-src` is used for audio/video elements. See https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Using_Content_Security_Policy#Example_3.

This adds a reasonable default.