[#4205] Allow any form-action CSP

[Viicos]

Fixes #4205.

I'm wondering if it makes sense to keep the ADDITIONAL_CSP_VALUES hardcoded values?

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 96.12%. Comparing base (fefada5) to head (72ea3e7).
Report is 17 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4223      +/-   ##
==========================================
- Coverage   96.13%   96.12%   -0.02%     
==========================================
  Files         733      729       -4     
  Lines       23538    23491      -47     
  Branches     2760     2757       -3     
==========================================
- Hits        22629    22580      -49     
- Misses        642      645       +3     
+ Partials      267      266       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[sergei-maertens]

I'm okay with this changeset, but I also think we can/should revert the mechanism then that digid/eherkenning/ogone add extra CSP items in the database, since realistically, that will all be covered by the https: directive...

[sergei-maertens]

Discussed with Joeri - we can remove the DigiD/eHerkenning/OgoneMerchant mechanism that updates the form-action CSP directive records, it's obsoleted by the setting changes.

[sergei-maertens]

The Ogone Merchant CSP update can also be removed :)

[sergei-maertens]

Backports:

• 2.6.x: 62e0a9d
• 2.5.x: 6c7abc4
• 2.4.x: 1b2775b