Add CSP directives to the Builder site

## 🎉 Description

Add the CSP directives either as a meta tag or as a header in the CF worker. Make them as restrictive as possible, trying to avoid inline scripts and styles.

Start by locating the CF worker entry point and the Builder site response path. Review whether CSP belongs in a meta tag or response header, then define restrictive directives that avoid inline scripts and styles; done means the site sends the intended CSP without breaking required behavior.

Written by the indexing model from the issue text.