content_policy_scheme_whitelist: add 'data' and 'javascript'