fix: allow gstatic.com in CSP img-src for merchant favicons

The favicon service used to show a merchant's icon in the price
comparison UI (www.google.com/s2/favicons) redirects to Google's gstatic
CDN (t0-t3.gstatic.com), which wasn't allowlisted — CSP silently blocked
the redirected image request (reported by some browsers as an opaque
response block rather than a clear CSP violation), so the 'Compare
prices' cheapest-offer favicon never rendered.

Added https://*.gstatic.com to img-src.

config/shield.ts

@@ -41,7 +41,17 @@ const shieldConfig = defineConfig({
       // (lost TuyauProvider context after a failed hot reload).
       workerSrc: [`'self'`, 'blob:'],
       styleSrc: [`'self'`, `'unsafe-inline'`, 'https://fonts.googleapis.com'],
-      imgSrc: [`'self'`, 'data:', 'https://fr.pc-builder.io', 'https://www.google.com'],
+      // The favicon service (used to show a merchant's icon in the price
+      // comparison UI) is requested from www.google.com but actually
+      // serves/redirects to Google's gstatic CDN (t0-t3.gstatic.com),
+      // hence the wildcard.
+      imgSrc: [
+        `'self'`,
+        'data:',
+        'https://fr.pc-builder.io',
+        'https://www.google.com',
+        'https://*.gstatic.com',
+      ],
       fontSrc: [`'self'`, 'data:', 'https://fonts.gstatic.com'],
     },