feat: serve pdf.js from this origin instead of a CDN

The Site pulled pdf.js 3.11.174 from cdnjs with no integrity attribute, and the
policy trusted the whole of cdnjs.cloudflare.com for both script-src and
worker-src. Anything that host served would have executed, and a customer
measuring a PDF sheet depended on it being reachable.

Vendor both files instead of pinning a hash: it removes the dependency rather
than constraining it, and lets the policy name only 'self'. Provenance and
SHA-256 digests are recorded in local/static/vendor/README.md, verified on
download against the SRI digests cdnjs publishes for that release.

cdnjs is now absent from script-src, worker-src and connect-src in both gateway
templates. Workers are 'self' plus blob:, which the Site needs for the worker it
constructs itself.

Verified in a browser against the running stack: pdf.js loads from /vendor/, the
blob worker starts, and a real seven-page PDF parses with no CSP violation. Both
browser suites and the full integration suite pass.

The version is deliberately unchanged. 3.11.174 is old, but its known eval path
is already closed by isEvalSupported:false, and upgrading is an API change that
needs its own testing rather than riding along with this.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dtf-site.html

@@ -1780,8 +1780,11 @@ function analisarFolha(img, larguraCm){
 
 // ── PDF também é conferido: rasteriza a página e mede o DPI das imagens de dentro.
 // Arte vetorial não tem resolução — nesses casos a nota é máxima, e isso é correto.
-const PDFJS_URL='https://cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.min.js';
-const PDFJS_WORKER='https://cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.worker.min.js';
+// Served from this origin, not a CDN: the Site keeps working when a third party
+// does not, and the CSP can name only 'self' for scripts and workers. Provenance
+// and hashes are recorded in local/static/vendor/README.md.
+const PDFJS_URL='/vendor/pdf.min.js';
+const PDFJS_WORKER=new URL('/vendor/pdf.worker.min.js', location.origin).href;
 let pdfLibP=null, temWorker=null;
 // Alguns navegadores e iframes bloqueiam Worker de blob. Descobrimos antes de
 // tentar, porque sem worker o PDF é lido na thread principal e precisa de outra