Configure manifest-src and worker-src in security policy