Default restrictive Content Security Policy for non-app requests

[kobelb]

Requests to load the client-side of Kibana will still be served with the content security policy defined with csp.rules, but other responses sent from Kibana server could include a content security policy that is especially restrictive.

For most static files this isn't necessary, but it also isn't harmful. For certain static files, like svgs, this policy will help protect against dynamic scripting when loading them directly in the browser.

Originally started #47375.

---

As noted in #47375, we should start by introducing a CSP of

'content-security-policy': default-src 'none'

for any response which does not itself include a CSP.

PR should also include functional (end-to-end) tests verifying this behavior.

This comment notes the following:

this likely breaks the graphql dev interface that is being used at least for SIEM.

I do not believe that SIEM uses graphql anymore, so this is likely something that we don't have to worry about.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)