fix: preview csp value

[bingryan]

Description

add preview csp value

Related Issue

Fixes #3253

Usage

--csp-origin http://localhost can fix safari Content Security Policy for ord server locally

[bingryan]

BTW, i add script-src-elem 'self' https://cdn.jsdelivr.net for default CONTENT_SECURITY_POLICY for some media, Please pay attention to this when code review.
@casey @raphjaph

[bingryan]

@raphjaph code review plz :)

[raphjaph]

Did you test if it works on Safari now?

[bingryan]

Check again, it's working for add `--csp-origin http://localhost`

• chrome
• Firefox
• Safari
• Edge
• Arc

[raphjaph]

LGTM!

[casey]

@bingryan Thanks for the PR! I refactored it to hopefully make it a bit clearer. The big change was that instead of appending the CSP origin, if present, I replaced 'self' with the CSP origin.

[bingryan]

@bingryan Thanks for the PR! I refactored it to hopefully make it a bit clearer. The big change was that instead of appending the CSP origin, if present, I replaced 'self' with the CSP origin.

thanks，casey.