Make autoCSP configurable

### Command

build

### Description

Great to see autoCSP property cause looks like it's the only way to go with PWA.
Please could you make possible to add extra options to generated CSP ? I'd love to specify for example `default-src`, `img-src` e.t.c.

### Describe the solution you'd like

Make it somehow configurable:

"autoCsp": {
"default-src": "'self'",
"img-src": "* data: blob:",
"media-src": "'self' data:"
}

### Describe alternatives you've considered

A header still will be needed for frame-ancestors to add (for example in nginx):

add_header Content-Security-Policy "frame-ancestors 'none'";

It works nicely in conjuction with autoCSP and I can even specify

add_header Content-Security-Policy "frame-ancestors 'none'; media-src 'self' data:";

The issue here is that if I add `default-src`

add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; media-src 'self' data:";

Angular app will be broken because the least permissive policy (this one) wins.
To workaround it I will have to specify each case separately here `worker-src; frame-src` e.t.c but _do not_ specify `script-src` which will make it enormous and hard to maintain.
I would love to specify them in index.html directly

從 CLI build 命令和現有的 autoCSP 產生路徑開始。追蹤產生的 Content-Security-Policy 如何組合，然後確認要求的指令可以設定，且產生的原則能在所述的 nginx 與 PWA 情境中正常運作。

由索引模型根據 Issue 內容生成。