Fix HLS and FLV playback in cross-site Live embeds (#833)

ddiff --git a/server/streaming/channel-embed.js b/server/streaming/channel-embed.js
iindex 585be1cb..f6713661 100644
---- a/server/streaming/channel-embed.js
++++ b/server/streaming/channel-embed.js
@@@ -43,7 +43,7 @@ async function page(req, res) {
      const db = require('../db/database');
      const channel = await db.getChannelByUsername(username).catch(() => null) || await db.getUserByUsername(username).catch(() => null);
      if (!channel) return res.sendStatus(404);
--    res.set('Content-Security-Policy', `default-src 'self'; script-src 'self' 'unsafe-inline' https://esm.sh; style-src 'self' 'unsafe-inline'; img-src 'self' https: data: blob:; media-src 'self' blob:; connect-src 'self' wss: https://esm.sh; frame-ancestors ${(await frameSites()).join(' ')}; base-uri 'none'; form-action 'none'`);
++    res.set('Content-Security-Policy', `default-src 'self'; script-src 'self' 'unsafe-inline' https://esm.sh https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' https: data: blob:; media-src 'self' blob:; connect-src 'self' wss: https://esm.sh; frame-ancestors ${(await frameSites()).join(' ')}; base-uri 'none'; form-action 'none'`);
      res.set('Cache-Control', 'no-store').set('X-Robots-Tag', 'noindex').type('html').send(html(await frameSites()));
  }
  module.exports = { page, frameSites, html, FALLBACK_SITES };
ddiff --git a/test/channel-embed.test.js b/test/channel-embed.test.js
iindex 37084850..722a56ac 100644
---- a/test/channel-embed.test.js
++++ b/test/channel-embed.test.js
@@@ -43,6 +43,7 @@ assert.strictEqual(video.muted, false, 'allowlisted parent can control playback'
      await embed.page({ params: { username: '@embedcheck' } }, known);
      assert.strictEqual(known.statusCode, 200, 'known channel route is served');
      assert.match(known.headers['Content-Security-Policy'], /frame-ancestors 'self' https:\/\/openvibe\.live https:\/\/openvibe\.network https:\/\/\*\.openvibe\.website/);
++    assert.match(known.headers['Content-Security-Policy'], /script-src [^;]*https:\/\/cdn\.jsdelivr\.net/, 'embedded HLS and FLV scripts can load under CSP');
      const missing = response();
      await embed.page({ params: { username: 'missing' } }, missing);
      assert.strictEqual(missing.statusCode, 404, 'unknown channel route is 404');