You need to declare all applicable Content permissions and External permissions in the Forge app manifest (initial support for this had by chance been introduced a few days before your question, see Introducing content security and egress controls).
- Please be aware of the Valid domain formats, which may be tricky for this particular use case (e.g. the “wildcard domain starting with
*” only works for the next level sub-domain, so you might ultimately need to resort to the “generic wildcard to support every domain” if you do not know all possible tile servers upfront.