Make autoCSP configurable

### Command

build

### Description

Great to see autoCSP property cause looks like it's the only way to go with PWA.
Please could you make possible to add extra options to generated CSP ? I'd love to specify for example `default-src`, `img-src` e.t.c.

### Describe the solution you'd like

Make it somehow configurable:

"autoCsp": {
"default-src": "'self'",
"img-src": "* data: blob:",
"media-src": "'self' data:"
}

### Describe alternatives you've considered

A header still will be needed for frame-ancestors to add (for example in nginx):

add_header Content-Security-Policy "frame-ancestors 'none'";

It works nicely in conjuction with autoCSP and I can even specify

add_header Content-Security-Policy "frame-ancestors 'none'; media-src 'self' data:";

The issue here is that if I add `default-src`

add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; media-src 'self' data:";

Angular app will be broken because the least permissive policy (this one) wins.
To workaround it I will have to specify each case separately here `worker-src; frame-src` e.t.c but _do not_ specify `script-src` which will make it enormous and hard to maintain.
I would love to specify them in index.html directly

Inizia con il comando di build della CLI e il percorso esistente di generazione di autoCSP. Traccia come viene assemblata la Content-Security-Policy generata, quindi verifica che le direttive richieste possano essere configurate e che la policy risultante funzioni con i casi nginx e PWA indicati.

Scritto dal modello di indicizzazione a partire dal testo della issue.