Add CSP (#301)

* Add CSP

Reduces the risk of accidentally leaking IP addresses to 3rd party
services.

* Also block api.github.com to avoid IP leak

I found no obvious way to disable that in mkdocs-material. If anyone
feels like digging:

- https://github.com/squidfunk/mkdocs-material/blob/9655c3a92471f261533d48b8611a8d24dbfebb13/src/assets/javascripts/components/source/facts/github/index.ts#L62
- https://github.com/squidfunk/mkdocs-material/blob/9655c3a92471f261533d48b8611a8d24dbfebb13/src/assets/javascripts/components/source/facts/_/index.ts#L77
- https://github.com/squidfunk/mkdocs-material/blob/9655c3a92471f261533d48b8611a8d24dbfebb13/src/assets/javascripts/components/source/_/index.ts#L88
- https://github.com/squidfunk/mkdocs-material/blob/9655c3a92471f261533d48b8611a8d24dbfebb13/src/assets/javascripts/components/source/_/index.ts#L120
- https://github.com/squidfunk/mkdocs-material/blob/9655c3a92471f261533d48b8611a8d24dbfebb13/src/assets/javascripts/bundle.ts#L198

* Removes GitHub star counter

As per the linked comment, removes the GitHub star counter, to avoid an
unnecessary call to the GitHub API.

squidfunk/mkdocs-material#2307 (comment)

Co-authored-by: Lars Larsson <lars.larsson@elastisys.com>

overrides/main.html

@@ -18,3 +18,12 @@
 </script>
 <!-- End Matomo Code -->
 {% endblock %}
+
+{% block extrahead %}
+<meta http-equiv="Content-Security-Policy" content="
+  default-src 'self';
+  img-src 'self' data:;
+  connect-src 'self' https://matomo.elastisys.com/;
+  script-src 'self' 'unsafe-inline';
+">
+{% endblock %}

overrides/partials/source.html

@@ -0,0 +1,12 @@
+{% import "partials/language.html" as lang with context %}
+
+<a
+  href="{{ config.repo_url }}"
+  title="{{ lang.t('source.link.title') }}"
+  style="display: block; font-size: .65rem; line-height: 1.2; white-space: nowrap; -webkit-backface-visibility: hidden; backface-visibility: hidden; transition: opacity 250ms;"
+>
+  <div class="md-source__icon md-icon">
+    {% set icon = config.theme.icon.repo or "fontawesome/brands/git-alt" %}
+    {% include ".icons/" ~ icon ~ ".svg" %}
+  </div>
+</a>