allow configuration of Content-Security-Policy

[wkloucek]

Is your feature request related to a problem? Please describe.

With the Web Embed mode, we actually need to set the Content-Security-Policy header.

Describe the solution you'd like

Similar to the oCIS CORS options there is a Content-Security-Policy option.

Describe alternatives you've considered

Leverage a reverse proxy that configures the Content-Security-Policy option.

That will be most of the time not be granular but a general rule like eg in nginx

more_set_headers "Content-Security-Policy: frame-ancestors 'self' https://foo.bar;";

Additional context

[wkloucek]

see:

• feat: add CSP and other security related headers in the oCIS proxy service #8777
• csp and other sec relevant headers .... #8761

[wkloucek]

Probably already implemented, need to reevaluate