Cleanup CSP headers

[Elnadrion]

Q	A
Documentation	no
Bugfix	yes
BC Break	yes
New Feature	no
RFC	no
QA	no

Description

This change cleans up the Content Security Policy header implementation and test suite to strictly follow the current CSP Level 3 specification

Target branch

Due to the BC break (previously accepted directives are now rejected), target the next major branch: 3.0.x.

What changed:

ContentSecurityPolicy

Removed deprecated/obsolete directives from the valid directives list:

• prefetch-src - https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/prefetch-src
• plugin-types - https://mdn2.netlify.app/en-us/docs/web/http/headers/content-security-policy/plugin-types/
• block-all-mixed-content - https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/block-all-mixed-content
• require-sri-for - https://udn.realityripple.com/docs/Web/HTTP/Headers/Content-Security-Policy/require-sri-for

ContentSecurityPolicyReportOnly

Defined a dedicated list appropriate for report-only usage, excluding enforcement-only directives (sandbox and upgrade-insecure-requests)

Why this is necessary:

• The library should reflect the current CSP3 spec and not accept obsolete directives. Accepting them may give a false sense of protection or produce non-spec headers
• Report-only header should only include directives that make sense in report-only mode