[web] set a default, strict CSP on ALL endpoints (#6271)

* Remove use of CSP_PERCENTAGE

* Move header calculation earlier

* Set a default policy and add comments

* Apply the CSP header to all responses

* Enable CSP in dev environment

* [web] set a default, strict CSP on ALL endpoints

* [misc] enable CSP in dev-env

* Only build the default policy once

* Update docker-compose.yml

* [web] webpack: set default CSP header on webpack assets

This aligns the webpack dev-server with production in nocdn=true mode.

Co-authored-by: Alf Eaton <alf.eaton@overleaf.com>
GitOrigin-RevId: 088a6082ad21c5b3f229887ba0ab3eca8d0528cd

services/web/webpack.config.dev.js

@@ -3,6 +3,7 @@ const merge = require('webpack-merge')
 const MiniCssExtractPlugin = require('mini-css-extract-plugin')
 
 const base = require('./webpack.config')
+const { buildDefaultPolicy } = require('./app/src/infrastructure/CSP')
 
 module.exports = merge(base, {
   mode: 'development',
@@ -30,6 +31,10 @@ module.exports = merge(base, {
     port: 3808,
     public: 'www.dev-overleaf.com:443',
 
+    headers: {
+      'Content-Security-Policy': buildDefaultPolicy(),
+    },
+
     // Customise output to the (node) console
     stats: {
       colors: true, // Enable some coloured highlighting