feature: adds dev-time CSP headers

[johncowen]

Adds stricter CSP headers to our development vite server.

Whilst this is dev time only, it ensures that our GUI runs on a similarly configured server (such as kumahq/kuma#12553)

---

As mentioned in other places, it would be good to add work so we can remove the style-src 'unsafe-inline'. This will require a globally available v-style directive which adds/removes/modifies styles imperatively behind the scenes.

Testing:

Using make run, add the following or similar anchor with an inline script and click it.

[netlify]

✅ Deploy Preview for kuma-gui ready!

Name	Link
🔨 Latest commit	08697df
🔍 Latest deploy log	https://app.netlify.com/sites/kuma-gui/deploys/6797614fe07b4c0008bc2b5f
😎 Deploy Preview	https://deploy-preview-3456--kuma-gui.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[schogges]

Great to have this 🙌
Just two nits 🙂 I think for both it doesn't hurt to add/remove them, so approving this anyways.

[johncowen]

Cool, thanks! I addressed the inlines also, remember this is only dev-time so we can always come back and tweak things here. If you spot anything that we would usually do in development that we now can't for whatever reason lemme know

Gonna go ahead and merge 👍

[johncowen]

Oh wait I just thought of something else I should check 😅 brb!

[johncowen]

😅 I added a straight-forward guard so we can turn this off in places we might need to. Later on I'll probably expand this so we can inject the config from The Outside

[johncowen]

As mentioned in other places, it would be good to add work so we can remove the style-src 'unsafe-inline'. This will require a globally available v-style directive which adds/removes/modifies styles imperatively behind the scenes.

I made #3458 which hopefully will allow us to remove the style-src 'unsafe-inline' also, so I'm gonna hold off on merge here wait for that and rebase.

[johncowen]

Hey sorry, I think I want to have only one PR go in for this as a single reference. At the moment I'm trying to make improve things by removing the need for unsafe-inline caused by other issues, so there is a little bit of change here even after the initial approval.

🤔 I'm going to move this to draft even though it has approval, and look for approval again once I'm happy that I've definitely finished here, just so its clearer what I'm doing.