chore: improve CSP add base uri restriction

[dpgaspar]

SUMMARY

Improves our current default CSP policy by adding base-uri to self. base-uri directive restricts the URLs which can be used in a document's element.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (8644b1a) 69.21% compared to head (45fab1b) 69.17%.
Report is 28 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #26251      +/-   ##
==========================================
- Coverage   69.21%   69.17%   -0.05%     
==========================================
  Files        1941     1942       +1     
  Lines       75910    75947      +37     
  Branches     8458     8458              
==========================================
- Hits        52541    52536       -5     
- Misses      21174    21216      +42     
  Partials     2195     2195              

Flag	Coverage Δ
hive	53.67% <ø> (-0.01%)	⬇️
mysql	78.08% <ø> (-0.07%)	⬇️
postgres	78.18% <ø> (-0.09%)	⬇️
presto	53.62% <ø> (-0.01%)	⬇️
python	82.86% <ø> (-0.10%)	⬇️
sqlite	76.83% <ø> (-0.09%)	⬇️
unit	55.79% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[kgabryje]

LGTM

[nytai]

@rusackas do we have any front-end logging enabled by default? This might affect any telemetry we might have recently added

[rusackas]

@rusackas do we have any front-end logging enabled by default? This might affect any telemetry we might have recently added

I think we'll be OK with the telemetry. The PR is still open until I sort out the tests, but the only change to the CSP change there just pokes a couple holes in the img-src setting.