Plugin badges on cordova.apache.org blocked by CSP

# Bug Report

## Problem

### What is expected to happen?

- shields.io and GitHub workflow badges for plugins should be displayed on cordova.apache.org like they are on the plugin readmes on GitHub, for example [cordova-plugin-inappbrowser/README.md](https://github.com/apache/cordova-plugin-inappbrowser/blob/master/README.md).

### What does actually happen?

- Badges are refused to load by Content security policy

## Information

Web developer console error logs:

```log
[Error] Refused to load https://img.shields.io/npm/v/cordova-plugin-inappbrowser/latest?label=Latest%20Release%20(npm) because it appears in neither the img-src directive nor the default-src directive of the Content Security Policy.
[Error] Refused to load https://img.shields.io/github/package-json/v/apache/cordova-plugin-inappbrowser?label=Development%20(Git) because it appears in neither the img-src directive nor the default-src directive of the Content Security Policy.
[Error] Refused to load https://github.com/apache/cordova-plugin-inappbrowser/actions/workflows/ci.yml/badge.svg?branch=master because it appears in neither the img-src directive nor the default-src directive of the Content Security Policy.
[Error] Refused to load https://github.com/apache/cordova-plugin-inappbrowser/actions/workflows/android.yml/badge.svg because it appears in neither the img-src directive nor the default-src directive of the Content Security Policy.
[Error] Refused to load https://github.com/apache/cordova-plugin-inappbrowser/actions/workflows/chrome.yml/badge.svg because it appears in neither the img-src directive nor the default-src directive of the Content Security Policy.
[Error] Refused to load https://github.com/apache/cordova-plugin-inappbrowser/actions/workflows/ios.yml/badge.svg because it appears in neither the img-src directive nor the default-src directive of the Content Security Policy.
[Error] Refused to load https://github.com/apache/cordova-plugin-inappbrowser/actions/workflows/lint.yml/badge.svg because it appears in neither the img-src directive nor the default-src directive of the Content Security Policy.
[Error] Refused to load https://github.com/apache/cordova-plugin-inappbrowser/actions/workflows/release-audit.yml/badge.svg?branch=master because it appears in neither the img-src directive nor the default-src directive of the Content Security Policy.
```

### Command or Code

### Environment, Platform, Device

### Version information

## Checklist

- [ ] I searched for existing GitHub issues
- [ ] I updated all Cordova tooling to most recent version
- [ ] I included all the necessary information above

Reproduce the problem on cordova.apache.org and inspect the site's Content Security Policy configuration, using the browser console errors and the listed shields.io and GitHub badge URLs as the starting points. Update the relevant image-source policy so the plugin badges load, then verify the badges display without CSP errors.

Written by the indexing model from the issue text.