TP2000-1644 Strengthen Content Security Policy configuration

[dalecannon]

TP2000-1644 Strengthen Content Security Policy configuration

Why

Recommendations have been made to improve the Content Security Policy (CSP) header.

What

• Bumps the version of django-csp to 3.8 which adds support for Trusted Types
• Adds object-src, base-uri, strict-dynamic and trusted-types directives to the CSP header
• Creates a default Trusted Types policy that acts as a fallback for third-party libraries that don't adhere to Trusted Types (e.g accessible-autocomplete)
• Adds dompurify JS package for use in default Trusted Types policy
• Bumps the version of django-debug-toolbar to 5.0.1 for compatibility with the newly added 'strict-dynamic' CSP directive

Checklist

• Requires migrations?
• Requires dependency updates? Yes

Links to relevant material

• Mozilla CSP overview
• w3c Trusted Types default policy
• web.dev Trusted Types
• Configuring django-csp