Make CSP header controllable by apps

[LukasReschke]

Currently we have some fairly open defaults. Optimally we should restrict the defaults as much as possible and allow apps to opt-in for requirements.

[BernhardPosselt]

Probably best to have a tag in info.xml like

<csp>
    <font-src>value</font-src>
</csp>

So its easy to parse and overwrite values already present in the default csp. It should build upon the current csp.

[LukasReschke]

So its easy to parse and overwrite values already present in the default csp. It should build upon the current csp.

I'd actually prefer to have this on the response instead. Then it can be also adjusted programmatically which is also a legitimate use-case.