fix(sim): allow jsdelivr script under helmet CSP

Backend/index.ts

@@ -43,7 +43,15 @@ app.use('/docs', swaggerUi.serve, swaggerUi.setup(openApiDocument));
 
 app.all('/api/auth/*splat', toNodeHandler(auth));
 
-app.use(helmet());
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        scriptSrc: ["'self'", 'https://cdn.jsdelivr.net'],
+      },
+    },
+  }),
+);
 app.use(
   cors({
     origin: trustedOrigins.length > 0 ? trustedOrigins : true,