TECH: CSP improvements

[luca-bruegger]

Remove hardcoded sentry url

In the moment is the sentry.puzzle.ch domain whitelisted as content-src in the CSP. That is subject to change in order to simplify the usage of cryptopus CSP for other Users.

CSP errors development

make sure there's no CSP error in development (localhost:3000)
it currently prevents loading of fonts

ToDo

• Familiarize your-self with Content Security Policy (CSP)
• https://guides.rubyonrails.org/security.html#content-security-policy
• Remove hardcoded puzzle sentry url
• Replace it with an env
• Add the url as secret into the gitlab repo
• Update integration, production
• Make sure CSP can be reported to sentry (exclude development)

[Vakmeth]

Is handled by #704