Custom Content-Security-Policy

**Is your feature request related to a problem? Please describe.**
Right now our Content-Security-Policy is static, it can't be changed unless you do some reverse-proxy manipulation. This leads to users not being able to do things like:
https://github.com/metabase/metabase/issues/7297 (in case we want to tackle it in the future)
https://github.com/metabase/metabase/issues/5462

**Describe the solution you'd like**
provide an env var to change this, so users can change it as needed in case they want to manipulate it without a reverse proxy

**Describe alternatives you've considered**
nginx doing it's thing

**How important is this feature to you?**
Customers need this to reduce their nginx rewriting

**Additional context**
NA

Start by locating where Metabase's static Content-Security-Policy is defined and how environment variables are read. Check the linked issues for the intended use cases and confirm the expected configuration format. Done means users can change the policy through an environment variable without reverse-proxy rewriting, with appropriate coverage for the affected behavior.

Written by the indexing model from the issue text.