fix: assorted CSP issues (#2323)

* hotfix: add CDN to the CSP connect directives

so that maplibre library can fetch and display these

* fix: add GTM URL to the CSP frame directive

* chore: removed unused blocked-by-CSP resource

* feat: add soundcloud to CSP frame directive

lib/dotcom_web/plugs/secure_headers.ex

@@ -12,6 +12,7 @@ defmodule DotcomWeb.Plugs.SecureHeaders do
       *.googleapis.com
       *.s3.amazonaws.com
       analytics.google.com
+      cdn.mbta.com
       px.ads.linkedin.com
       stats.g.doubleclick.net
       www.google-analytics.com
@@ -28,7 +29,9 @@ defmodule DotcomWeb.Plugs.SecureHeaders do
       livestream.com
       www.youtube.com
       www.google.com
+      www.googletagmanager.com
       www.instagram.com
+      *.soundcloud.com
     ],
     img: ~w[
       img-src

lib/dotcom_web/templates/layout/root.html.eex

@@ -27,7 +27,6 @@
     <link rel="apple-touch-icon" href="<%= static_url(@conn, "/apple-touch-icon.png") %>" type="image/png">
     <link rel="icon" href="<%= static_url(@conn, "/images/mbta-logo-t-favicon.png") %>" sizes="32x32" type="image/png">
     <link rel="icon" href="<%= static_url(@conn, "/favicon.ico") %>" sizes="16x16" type="image/vnd.microsoft.icon">
-    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/flatpickr/dist/flatpickr.min.css">
 
     <%= if google_tag_manager_id() do %>
       <link rel="preconnect" href="//www.google-analytics.com">