Add Content-Security-Policy header (#3783)

* Add Content-Security-Policy header
* Add nonce attribute to script tags
* Use source-map for webpack devtool
* Add ng-csp attribute when CSP is enabled
* Allow overriding CSP settings with environment variables
* Hook into render and allow routes to disable the CSP header

GitOrigin-RevId: a873736a3514198165f1b2f1e18d002b65f20d30

services/web/webpack.config.dev.js

@@ -7,7 +7,7 @@ module.exports = merge(base, {
   mode: 'development',
 
   // Enable accurate source maps for dev
-  devtool: 'eval-source-map',
+  devtool: 'source-map',
 
   plugins: [
     // Extract CSS to a separate file (rather than inlining to a <style> tag)