[WebAPI.WebAPI] Fix Content Security Policy header

[726b]

Content Security Policy header should contain the following values:

default-src 'none';
base-uri 'none';
object-src 'none';
frame-ancestors 'none';
connect-src 'self' https://www.google.com;
script-src 'self' 'strict-dynamic' 'sha256-CHANGE_THIS' https://www.google.com https://www.gstatic.com;
style-src 'self' https://www.gstatic.com 'unsafe-inline';
frame-src 'self' https://www.google.com;
img-src 'self' data: blob: https://www.gstatic.com;
font-src 'self' data: blob: https://fonts.gstatic.com;
worker-src 'self' https://www.google.com https://www.gstatic.com;
child-src 'self' https://www.google.com https://www.gstatic.com;
media-src 'self';
form-action 'self';
require-trusted-types-for 'script'

Google reCAPTCHA URLs are included and will work by default.

Also, please note that in order to @import fonts from Google Fonts, you should add https://fonts.googleapis.com to style-src.

References:

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
• https://developers.google.com/web/fundamentals/security/csp
• https://web.dev/strict-csp
• https://content-security-policy.com