This tests that a blob-URL JavaScript script fails to load because it does not match Content Security Policy script-src 'self'.