feat(#1869): Allow script-src and connect-src configuration

[timo-reymann]

Fixes #1869
Fixes #259

As discussed in LycheeOrg/Lychee#1896, this enables modification of the Content Security Policy, allowing users to integrate Trackers as Matomo, Google Analytics, etc. as well as loading JavaScript from external sources.

This is compatible with previous versions and the setting doesn't need to be set explicitly with an env var.

The following example JavaScript works with the new settings (Matomo tracker):

var _paq = window._paq = window._paq || [];
_paq.push(['trackPageView']);
_paq.push(['enableLinkTracking']);
(function() {
  var u="https://analytics.example.com/";
  _paq.push(['setTrackerUrl', u+'matomo.php']);
  _paq.push(['setSiteId', '<site-id>']);
  var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
  g.async=true; 
  g.src=u+'matomo.js'; 
  s.parentNode.insertBefore(g,s);
})();

navigation.addEventListener("navigate", function(e) {
  _paq.push(['setDocumentTitle', document.title]);
  _paq.push(['trackPageView']);
});

Assuming the following env vars are set:

SECURITY_HEADER_SCRIPT_SRC_ALLOW=https://analytics.example.com/matomo.js
SECURITY_HEADER_CSP_CONNECT_SRC=https://analytics.example.com/matomo.js

Also supports multiple values separated by spaces.

[ildyria]

LGTM.

[ildyria]

LGTM.

[codecov]

Codecov Report

Merging #1870 (b11b5eb) into master (1a0b831) will decrease coverage by 0.48%.
The diff coverage is n/a.

Additional details and impacted files