Switch Leaflet from unpkg to jsdelivr CDN to avoid sourcemap requests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

assets/modules/event-map.js

@@ -7,11 +7,11 @@ export function initEventMap() {
 
     const link = document.createElement('link')
     link.rel = 'stylesheet'
-    link.href = 'https://unpkg.com/leaflet@1.9.4/dist/leaflet.css'
+    link.href = 'https://cdn.jsdelivr.net/npm/leaflet@1.9.4/dist/leaflet.min.css'
     document.head.appendChild(link)
 
     const script = document.createElement('script')
-    script.src = 'https://unpkg.com/leaflet@1.9.4/dist/leaflet.js'
+    script.src = 'https://cdn.jsdelivr.net/npm/leaflet@1.9.4/dist/leaflet.min.js'
     script.onload = () => geocodeAndRender(address, mapEl)
     document.head.appendChild(script)
 }

config/packages/nelmio_security.yaml

@@ -32,20 +32,20 @@ nelmio_security:
                 - 'self'
                 - 'https://static.cloudflareinsights.com'
                 - 'https://challenges.cloudflare.com'
-                - 'https://unpkg.com'
+                - 'https://cdn.jsdelivr.net'
                 - 'unsafe-inline'
             style-src:
                 - 'self'
                 - 'https://fonts.googleapis.com'
                 - 'https://cdnjs.cloudflare.com'
-                - 'https://unpkg.com'
+                - 'https://cdn.jsdelivr.net'
                 - 'unsafe-inline'
             img-src:
                 - 'self'
                 - 'data:'
                 - 'https://*.tile.openstreetmap.org'
                 - 'https://*.basemaps.cartocdn.com'
-                - 'https://unpkg.com'
+                - 'https://cdn.jsdelivr.net'
             worker-src:
                 - 'self'
                 - 'blob:'