feat: enable content security policy (CSP)

[mschoettle]

Enables CSP which is a new feature in Django 6.

Builds on

• fix(deps): update dependency django to v6 #1841

[staceybeard]

It's good to enable CSP, but in my experience it causes a lot of new errors to show up, so I'd suggest keeping an eye out for problems in the next couple of weeks.

[mschoettle]

It's good to enable CSP, but in my experience it causes a lot of new errors to show up, so I'd suggest keeping an eye out for problems in the next couple of weeks.

Absolutely.
I tested with SECURE_CSP_REPORT_ONLY first and the amount of included JavaScript is fairly limited. That's how I found the problems with the embedded plotlyjs.