Content Security Policy: add `base-uri`

Right now https://observatory.mozilla.org/ gives Rank B, adding `base-uri 'none'` increases it to `A+`

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/base-uri

No file or test is named. Start by locating where the Content-Security-Policy response header is configured, then consult the linked MDN description and verify the Observatory result; done means the header includes base-uri 'none' and the change is covered by the repository's relevant checks.

Written by the indexing model from the issue text.