CSP error for Thumbnails and Download button

Describe the bug CSP/Content Security Policy

I've seen that there have already been some issues that are CSP related and work has been done to prevent those errors, however when clicking on a thumbnail in the thumbnail panel I'm receiving a CSP error possibly introduced by using href="javascript:;", the download button has the same href after looking at the code.

To Reproduce Steps to reproduce the behavior:

1. Go to a website that has CSP headers enabled
2. Click on a thumbnail button in the thumbnail panel
3. See error in Chrome Console

Expected behavior Fancybox being 100% CSP compliant

Additional context No context here....just....Great work btw and thanks for fancybox.