fix: #18321 unescape create-quasar CSP self sources

[cyphercodes]

What kind of change does this PR introduce?

• Bugfix
• Feature
• Documentation
• Code style update
• Refactor
• Build-related changes
• Other, please describe:

Does this PR introduce a breaking change?

• Yes
• No

The PR fulfills these requirements:

• It's submitted to the dev branch (or v[X] branch)
• When resolving a specific issue, it's referenced in the PR's title (e.g. fix: #xxx[,#xxx], where "xxx" is the issue number)
• It's been tested on a Cordova (iOS, Android) app
• It's been tested on an Electron app
• Documentation is not required; this fixes generated template output.

Other information:

Fixes #18321.

This removes the extra escaping around connect-src 'self' and worker-src 'self' in the generated dev CSP template output for Vite 3 app templates, plus the matching app-extension playground templates.

Test plan:

• Rendered each touched create-quasar template through the first-stage create-quasar renderer, then through the app-vite HTML renderer with ctx.dev: true, and asserted the final CSP contains unescaped 'self' sources.
• git diff --check HEAD~1..HEAD