Create Custom CSP

[K8Sewell]

Summary

To ensure feature parity until all open source resources are updated to not use inline scripts or styles 'unsafe-inline' was added to the default CSP. It is possible to customize the CSP per page and this will allow for a more secure policy - only allow 'unsafe-inline' in very specific cases until open source packages have updated their style and script injections.

Acceptance Criteria

• 'unsafe-inline' is removed from the default CSP and all features that require it have their own custom CSP

Engineering Notes

https://api.rubyonrails.org/classes/ActionController/ContentSecurityPolicy/ClassMethods.html#method-i-content_security_policy

#2875 - related ticket

Exceptions to Mitigate

• Mirador
• Blacklight Range Limit
• Webpacker
• Font Awesome
• OnClick actions in search bar