feat(csp): declare the frame-src sources the preview reference needs

[markdumay]

Problem

The preview block reference embeds three sites to demonstrate the component. Two of them require a
CSP frame-src source from the consuming site, and neither was declared anywhere — so the page
rendered two empty boxes on every site that ships this content, including
demo.gethinode.com and
gethinode.com.

Embedded	Sends	Needs a frame-src source?
en.wikipedia.org	no framing restriction	✅ yes
www.openstreetmap.org	no framing restriction	✅ yes
google.com	X-Frame-Options: SAMEORIGIN	❌ no — cannot be framed at all

The google.com preview is intentional: it demonstrates a site that refuses to be framed, and
correctly falls back to a screenshot. It needs no source.

Change

Declare the two sources in hugo.toml, so consuming sites inherit them:

[params.modules.docs.csp]
    frame-src = [
        "*.wikipedia.org",
        "www.openstreetmap.org"
    ]

This follows the established pattern — mod-leaflet declares img-src = ["tile.openstreetmap.org"]
for the same reason, and mod-cookieyes declares its own script-src/connect-src. The module that
embeds a host should declare what it needs.

Right now each site hand-maintains the list instead, which is exactly how the two drifted apart:
gethinode.com had *.wikipedia.org but not www.openstreetmap.org, so its OpenStreetMap preview
was broken while its Wikipedia one worked.

Verification

Built the hinode exampleSite against this branch (workspace use), with the site-level entries
removed, so the sources come only from here:

en.wikipedia.org        live
www.openstreetmap.org   live
google.com              fallback   (screenshot, as intended)

No CSP warnings. Removing this declaration flips Wikipedia and OpenStreetMap back to a fallback
with a build warning (with gethinode/mod-blocks#152), confirming the sources are what make them
render.

Follow-up

Once this is released, the site-level entries can be dropped from gethinode/hinode #2008 and
gethinode/gethinode.com #154 in favour of a mod-docs bump.

🤖 Generated with Claude Code

[markdumay]

🎉 This PR is included in version 1.15.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀