CSP Enabled Verification

[RishiRajSahu]

As reported by security tools we need to remove the unsafe- directives from CSP header in order comply with security policies as this directive makes the CSP too permissive

Code Link : https://github.com/topcoder-platform/micro-frontends-frame/blob/dev/src/index.ejs#L23
Atlassian link - https://topcoder.atlassian.net/browse/VULN-2201

fyi @urwithat @mtwomey

[RishiRajSahu]

this is the least permissive CSP header for https://platform.topcoder-dev.com
default-src 'none'; base-uri 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://js.stripe.com https://w.chatlio.com https://static.filestackapi.com https://s7.addthis.com https://z.moatads.com https://v1.addthisedge.com https://m.addthis.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://w.chatlio.com https://static.filestackapi.com; img-src * data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.topcoder-dev.com https://community-app.topcoder-dev.com https://*.filestackapi.com https://*.s3.amazonaws.com https://www.topcoder-dev.com https://api.chatlio.com https://api-cdn.chatlio.com https://raw.githubusercontent.com http://api.topcoder.com https://petstore.swagger.io http://petstore.swagger.io; frame-src https://accounts-auth0.topcoder-dev.com https://js.stripe.com https://s7.addthis.com; media-src https://w.chatlio.com; frame-ancestors none; form-action 'self';
For production platform.topcoder.com, this is the CSP header (replace topcoder-dev with topcoder)
default-src 'none'; base-uri 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://js.stripe.com https://w.chatlio.com https://static.filestackapi.com https://s7.addthis.com https://z.moatads.com https://v1.addthisedge.com https://m.addthis.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://w.chatlio.com https://static.filestackapi.com; img-src * data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.topcoder.com https://community-app.topcoder.com https://*.filestackapi.com https://*.s3.amazonaws.com https://www.topcoder.com https://api.chatlio.com https://api-cdn.chatlio.com https://raw.githubusercontent.com http://api.topcoder.com https://petstore.swagger.io http://petstore.swagger.io; frame-src https://accounts-auth0.topcoder.com https://js.stripe.com https://s7.addthis.com; media-src https://w.chatlio.com; frame-ancestors none; form-action 'self';