CSP script-src-elem에 youtube 포함하기

[kimkanu]

Refused to load the script 'https://www.youtube.com/iframe_api' because
it violates the following Content Security Policy directive: "script-src 'self' 
'unsafe-inline'". Note that 'script-src-elem' was not explicitly set, so 
'script-src' is used as a fallback.

[kimkanu]

일단 wildcard 넣어서 해결