Content-Security-Policy: The page’s settings blocked the loading of a resource at blob: (“default-src”).

I'm not sure that I can help here beyond validating that Drupal and the CSP module are outputting the header as expected.
Rather than setting default-src, you can set the more specific directives to see which one is actually being violated and needs the additional protocol without allowing it more broadly. (The module will remove additional directives if they fallback to default-src and are set to the same value though, so you will need to disable or change default-src while testing - even just adding a fake url would work).

blob: is the correct formatting to use in that field for the protocol (as checked by the form validation)