Fix: add to CSP_FRAME_SRC

[angela-tran]

Closes #2445

#2445 revealed that in production, the frame-src directive only includes google.com and therefore blocks the transit processor iframe.

This is because in settings.py, the logic was to throw away the originally assigned value of CSP_FRAME_SRC and instead use whatever is in env_frame_src.

benefits/benefits/settings.py

Lines 310 to 315 in 8cce5ad

	CSP_FRAME_SRC = ["*.littlepay.com"]
	env_frame_src = _filter_empty(os.environ.get("DJANGO_CSP_FRAME_SRC", "").split(","))
	if RECAPTCHA_ENABLED:
	env_frame_src.append("https://www.google.com")
	if len(env_frame_src) > 0:
	CSP_FRAME_SRC = env_frame_src

This logic was fine when the originally assigned value was 'none' since the directive only allows 'none' or a space separated list of values, but in a23b51e2, we changed it to be *.littlepay.com since we know we will always need to allow that as an iframe source.

This PR fixes it so we add to CSP_FRAME_SRC instead of re-assigning it.

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
benefits
settings.py					315
Project Total

This report was generated by python-coverage-comment-action

[lalver1]

This looks good 👍
I saw that before this PR, *.littlepay.com only appeared in script-src in the CSP header but now it also appears in frame-src.

[thekaveman]

Yep, looks good 👍

Now that we're initializing the frame src with the Littlepay domain, no need to replace.