Make autoCSP configurable

### Command

build

### Description

Great to see autoCSP property cause looks like it's the only way to go with PWA.
Please could you make possible to add extra options to generated CSP ? I'd love to specify for example `default-src`, `img-src` e.t.c.

### Describe the solution you'd like

Make it somehow configurable:

"autoCsp": {
"default-src": "'self'",
"img-src": "* data: blob:",
"media-src": "'self' data:"
}

### Describe alternatives you've considered

A header still will be needed for frame-ancestors to add (for example in nginx):

add_header Content-Security-Policy "frame-ancestors 'none'";

It works nicely in conjuction with autoCSP and I can even specify

add_header Content-Security-Policy "frame-ancestors 'none'; media-src 'self' data:";

The issue here is that if I add `default-src`

add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; media-src 'self' data:";

Angular app will be broken because the least permissive policy (this one) wins.
To workaround it I will have to specify each case separately here `worker-src; frame-src` e.t.c but _do not_ specify `script-src` which will make it enormous and hard to maintain.
I would love to specify them in index.html directly

从 CLI build 命令和现有的 autoCSP 生成路径开始。跟踪生成的 Content-Security-Policy 是如何组装的，然后验证所请求的指令是否可以配置，以及生成的策略是否能在所述的 nginx 和 PWA 场景中正常工作。

由索引模型根据 Issue 内容生成。