Set default-src to 'self'

By default, allow any resources from self
Applies to anything not covered by other directives
Use combined.svg as an external resource

Instead of using <use xlink:href="#id">, <use xlink:href="URL#id>