fix(files): address PR review findings

- csp.ts: revert bare https: from img-src — it defeats the existing
  domain allowlist and opens info-leakage vectors
- files/page.tsx + files/[fileId]/page.tsx: add explicit fallback={null}
  to <Suspense> to make intent clear (React defaults to null, but
  omitting it looks like an oversight)
- preview-panel.tsx: restore pre passthrough in STATIC_MARKDOWN_COMPONENTS
  so Streamdown's wrapping <pre> doesn't nest inside the custom code
  block <div>, which produced invalid HTML and broken styling
- file-viewer.tsx: add 'webm' to VIDEO_PREVIEWABLE_EXTENSIONS to match
  'video/webm' in VIDEO_PREVIEWABLE_MIME_TYPES

apps/sim/app/workspace/[workspaceId]/files/[fileId]/page.tsx

@@ -9,7 +9,7 @@ export const metadata: Metadata = {
 
 export default function FilesFilePage() {
   return (
-    <Suspense>
+    <Suspense fallback={null}>
       <Files />
     </Suspense>
   )

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-viewer.tsx

@@ -133,7 +133,7 @@ const VIDEO_PREVIEWABLE_MIME_TYPES = new Set([
   'video/x-matroska',
   'video/webm',
 ])
-const VIDEO_PREVIEWABLE_EXTENSIONS = new Set(['mp4', 'mov', 'avi', 'mkv'])
+const VIDEO_PREVIEWABLE_EXTENSIONS = new Set(['mp4', 'mov', 'avi', 'mkv', 'webm'])
 
 const PPTX_PREVIEWABLE_MIME_TYPES = new Set([
   'application/vnd.openxmlformats-officedocument.presentationml.presentation',

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-panel.tsx

@@ -302,6 +302,7 @@ const MermaidDiagram = memo(function MermaidDiagram({ definition }: { definition
 })
 
 const STATIC_MARKDOWN_COMPONENTS = {
+  pre: ({ children }: { children?: React.ReactNode }) => <>{children}</>,
   p: ({ children }: { children?: React.ReactNode }) => (
     <p className='mb-3 break-words text-[14px] text-[var(--text-primary)] leading-[1.6] last:mb-0'>
       {children}

apps/sim/app/workspace/[workspaceId]/files/page.tsx

@@ -9,7 +9,7 @@ export const metadata: Metadata = {
 
 export default function FilesPage() {
   return (
-    <Suspense>
+    <Suspense fallback={null}>
       <Files />
     </Suspense>
   )

apps/sim/lib/core/security/csp.ts

@@ -65,7 +65,6 @@ const STATIC_IMG_SRC = [
   "'self'",
   'data:',
   'blob:',
-  'https:',
   'https://*.googleusercontent.com',
   'https://*.google.com',
   'https://*.atlassian.com',