This release fixes the security headers added in v2.8.2-beta, which blocked parts of the web app in the browser.

## Improvements and fixes

- The web app's icons now display again. They are bundled into the app instead of being fetched from an external icon service, which the security policy blocked.
- The light and dark mode script in the page is now allowed by the security policy, so the color mode no longer fails to apply on load.
- The security policy now allows WebAssembly, which parts of the web app need.

## Under the hood

- Add a Vite plugin that bundles only the Lucide icons the app uses.
- Compute a hash for each inline script in the served page and add it to the `script-src` directive, instead of allowing inline scripts in general.
- Update the security headers tests.

## Upgrading

- Replace the binary, or pull the new image. No schema change and no new environment variable.
- If you are on v2.8.2-beta, upgrade: that version's policy broke icons and color mode.