Metadata page requires style-src hash in CSP

[baszoetekouw]

For some reason, the metadata page of engineblock won't display properly in Edge/Chrome without a CSP style-src hash. Investigate why this hapens.

[baszoetekouw]

Note: currently no CSP header is set on engine.

[johanib]

Discussed: On prod, no CSP header is set. We see no reason why this is not set stricter. But when the style-src is restricted, the metadata page does not show properly.

So investigate why, and restrict the style-src CSP.

[baszoetekouw]

This the (stricter) CSP that we would like to use, if feasible:

content-security-policy: default-src 'none'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; img-src 'self' https://static.openconex.org http://localhost:* data:; form-action 'self'; frame-ancestors 'none'; base-uri 'none'