CSP: Remove deprecated prefetch-src 

We use `prefetch-src` in the CSP header, which is deprecated (console error) and should be removed.

See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/prefetch-src