Make autoCSP configurable

### Command

build

### Description

Great to see autoCSP property cause looks like it's the only way to go with PWA.
Please could you make possible to add extra options to generated CSP ? I'd love to specify for example `default-src`, `img-src` e.t.c.

### Describe the solution you'd like

Make it somehow configurable:

"autoCsp": {
"default-src": "'self'",
"img-src": "* data: blob:",
"media-src": "'self' data:"
}

### Describe alternatives you've considered

A header still will be needed for frame-ancestors to add (for example in nginx):

add_header Content-Security-Policy "frame-ancestors 'none'";

It works nicely in conjuction with autoCSP and I can even specify

add_header Content-Security-Policy "frame-ancestors 'none'; media-src 'self' data:";

The issue here is that if I add `default-src`

add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; media-src 'self' data:";

Angular app will be broken because the least permissive policy (this one) wins.
To workaround it I will have to specify each case separately here `worker-src; frame-src` e.t.c but _do not_ specify `script-src` which will make it enormous and hard to maintain.
I would love to specify them in index.html directly

Beginne mit dem CLI-Build-Befehl und dem bestehenden autoCSP-Generierungspfad. Verfolge, wie die generierte Content-Security-Policy zusammengesetzt wird, und überprüfe anschließend, dass die angeforderten Direktiven konfiguriert werden können und dass die resultierende Richtlinie mit den genannten nginx- und PWA-Fällen funktioniert.

Vom Indexierungsmodell aus dem Issue-Text verfasst.