Fix Vite HMR Content Security Policy rules

Previously the Vite HMR Content Security Policy rules would
assume that NGINX were in the loop: the allowed hostname
would be the GitLab hostname + `/vite-dev`. However, for
users running without NGINX, the browser might try to access
the HMR host directly via `localhost` or `127.0.0.1`, which would
not be permitted by the current rules.

We fix this by using the HMR host set in the Vite GDK helper using the
`VITE_HMR_HTTP_URL` and `VITE_HMR_WS_URL` environment variables set
there. We need both HTTP and Websocket URLs because Vite will ping the
HTTP URL if the Websocket becomes unreachable.

Changelog: fixed