[Demand] Enable Content Security Policy

[Jack-Works]

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Roadmap

• [x] Setup a CSP report server
• [ ] Have a CSP list and generate appropriate CSP policy string
• [ ] Enable report-only CSP in development mode
• [ ] Add good URLs to the allow list
• [ ] Enable report-only CSP in production mode
• [ ] Enable strict CSP in development mode
• [ ] Enable strict CSP in production mode