STCLI-286 - Add static CSP capabilities to stripes-cli

[JohnC-80]

STCLI-286

This will allow you to try out a Content-Security-Policy header locally via stripes serve --existingBuild functionality...

Serving an existing build is the suggested way to do this as it's closest to what's going to be happening in production, otherwise other values have to be added to account for the bundler's way of providing scripts through its dev server.

Usage:
have your CSP content in a text file - ex csp.txt

default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;

Build a platform, serve it with the --existingBuild flag (build defaults to ./output)

yarn stripes serve --existingBuild ./output --csp-file ./csp.txt

The CSP is served as a Content-Security-Policy-Read-Only header and will report in the browser console:

[github-actions]

Jest Unit Test Results

0 tests  ±0   0 ✅ ±0   0s ⏱️ ±0s
0 suites ±0   0 💤 ±0 
0 files   ±0   0 ❌ ±0 

Results for commit 3b137c0. ± Comparison against base commit 75983b9.

♻️ This comment has been updated with latest results.

[sonarqubecloud]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud