CSP: add additional restrictions (#854)

object-src none and base-uri none are recommended by https://web.dev/articles/strict-csp

frame-ancestors none can be added since lib-jobs has no reason to be embedded in an iframe.
This is an additional protection, on top of our X-Frame-Options: SameOrigin

config/initializers/content_security_policy.rb

@@ -1,24 +1,10 @@
 # frozen_string_literal: true
-# Be sure to restart your server when you modify this file.
-
-# Define an application-wide content security policy
-# For further information see the following documentation
-# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
-
-# Rails.application.config.content_security_policy do |policy|
-#   policy.default_src :self, :https
-#   policy.font_src    :self, :https, :data
-#   policy.img_src     :self, :https, :data
-#   policy.object_src  :none
-#   policy.script_src  :self, :https
-#   policy.style_src   :self, :https
-
-#   # Specify URI for violation reports
-#   # policy.report_uri "/csp-violation-report-endpoint"
-# end
 
 Rails.application.config.content_security_policy do |policy|
   policy.script_src :self, :https, :unsafe_eval
+  policy.object_src :none
+  policy.base_uri :none
+  policy.frame_ancestors :none
 end
 
 # If you are using UJS then enable automatic nonce generation