[Bug] Allow CSP headers for worker scripts

[antross]

From @annevk

And Content-Security-Policy is also relevant to workers, which use a JavaScript MIME type (typically).

The worker case is also interesting and not currently covered. I agree webhint should allow this, though if possible still flag the headers when a script is being used somewhere other than a worker. I'll open a separate issue to track updating the implementation.

Originally posted by @antross in #2342 (comment)