### Pre-flight checklist

- [X] I have read the [contribution documentation](https://github.com/electron/forge/blob/main/CONTRIBUTING.md) for this project.
- [X] I agree to follow the [code of conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) that this project uses.
- [X] I have searched the issue tracker for a bug that matches the one I want to file, without success.

### Electron Forge version

6.0.5

### Electron version

23.1.4

### Operating system

macOS 11.7.4 (20G1120)

### Last known working Electron Forge version

_No response_

### Expected behavior

Using `devContentSecurityPolicy` in the `forge.config.js` with `@electron-forge/plugin-webpack` should use the content security policy given in the prop and not the content security policy specified in the meta tag in `index.html`.

```
// forge.config.json
plugins: [
{
name: '@electron-forge/plugin-webpack',
config: {
devContentSecurityPolicy: `default-src 'self' 'unsafe-inline' data:; script-src 'self' 'unsafe-eval' 'unsafe-inline' data:`,
mainConfig: './webpack.main.config.js',
renderer: {
config: './webpack.renderer.config.js',
entryPoints: [
{
name: 'main_window',
html: './src/renderer/index.html',
js: './src/renderer/index.js',
preload: {
js: './src/preload.js'
}
}
]
}
}
}
]

// index.html

Hello World!

💖 Hello World!

Welcome to your Electron application.

```

See: https://www.electronforge.io/config/plugins/webpack#devcontentsecuritypolicy

### Actual behavior

When running `npm start` in development, it should use the specified CSP in the config.

### Steps to reproduce

1. Clone: https://github.com/wrgoto/electron-forge-csp/tree/main
2. `npm start`
3. Content security policy is using the meta tag attribute not the `devContentSecurityPolicy`

### Additional information

_No response_