[Bug/Feature Request] Content-Security-Policy issues

Nobody has claimed this yet.

As of 2025/06/14:

`iframeResizer` isn't hosted locally via Forge, it's currently set to pull it remotely from `https://cdnjs.cloudflare.com/ajax/libs/iframe-resizer/4.3.1/iframeResizer.contentWindow.min.js`. This should be hosted locally (MIT license, should be fine to do so, just include a copy of the MIT license and leave the comment header in the JavaScript as it already is). The UI won't load it without carving out exceptions in the Content-Security-Policy header and that just introduces "trust this remote endpoint, no matter what".

CSP source(s) of `'self'` are recommended and considered most secure aside from `'none'`, so the following issues are still present for locally-hosted content.

Various inline JavaScript should be moved to JavaScript file(s) instead. `*.svelte` causes most of these issues (HTML, Textbox).

Various images are loaded via `data` instead of CSS.

Issues are present mostly from `fields.js`, `observer-helper.js`, `ui_settings_hints.js`, `utils.js` as well. There could be many more files, I haven't gone too deeply.

Start by auditing the *.svelte files and the named fields.js, observer-helper.js, ui_settings_hints.js, and utils.js files for the reported remote, inline, and data-loaded content. Check the current Content-Security-Policy behavior, then define completion as locally hosting iframeResizer with its MIT license and eliminating the reported CSP violations without broad remote exceptions.

Written by the indexing model from the issue text.