[Demand] Enable Content Security Policy

[Jack-Works]

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Roadmap

• Setup a CSP report server
• Have a CSP list and generate appropriate CSP policy string
• Enable report-only CSP in development mode
• Add good URLs to the allow list
• Enable report-only CSP in production mode
• Enable strict CSP in development mode
• Enable strict CSP in production mode