Setup Content Security Policy header

[mtracz]

We should implement CSP header.

Actually https://observatory.mozilla.org/analyze/toby.blumilk.pl
shows 75/100 score because of that.

I think we can set it in docker compose label as Traefik header middleware or via meta tag.
Rules below should be validated to prevent blocking img-src or font-src.
e.g.

traefik.http.middlewares.csp-header.headers.contentSecurityPolicy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; frame-src 'self'; object-src 'none'; require-trusted-types-for 'script';"

# or

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; frame-src 'self'; object-src 'none'; require-trusted-types-for 'script';">

Then add this middleware csp-header@docker to traefik.http.routers.toby-prod-app.middlewares.

https://infosec.mozilla.org/guidelines/web_security#content-security-policy
https://csp-evaluator.withgoogle.com/