bit, warn on configurable list of world-writable domains in csp headers

[underdarknl]

Is your feature request related to a problem? Please describe.
We should create a bit that does the following:
for all domains allow-listed in CSP headers:
check if domain is listed in a list of configured dangerous domains.

This list could be a config_ooi listing domains like:

• www.jsdelivr.com
• githubpages.com
• cdn.skypack.dev

Those domains can host any JS or files from anyone, which immediately negates the whole point of using CSP to allow only secure domains.

Describe alternatives you've considered
Dont use a config, just hard-code the list in the bit.

[underdarknl]

https://github.com/mayakyler/link-shorteners is a list of url shorteners, which by definition are also world-writable