[JENKINS-76302] Make GH org avatars work with CSP

[daniel-beck]

Description

This ensures GitHub org avatar images (the "folder icon") work in forthcoming Jenkins core releases when CSP protection is enforced.

See JENKINS-76302 for further information.

To manually test, create a GH organization folder and the icon needs to work while CSP is enforced (see core PR).

Submitter checklist

• Link to JIRA ticket in description, if appropriate.
• Change is code complete and matches issue description
• Automated tests have been added to exercise the changes
• Reviewer's manual test instructions provided in PR description. See Reviewer's first task below.

Reviewer checklist

• Run the changes and verify that the change matches the issue description
• Reviewed the code
• Verified that the appropriate tests have been written or valid explanation given

Documentation changes

• Link to jenkins.io PR, or an explanation for why no doc changes are needed

Users/aliases to notify

[rsandell]

@scherler was working on something related in branch-source-plugin, I doubt they'll interfere but making a friendly ping anyway.

[jglick]

I do not really understand the security implications but presumably you do.

Just some technical requests here.