Add Content-Security-Policy setting for CMS

There currently is not a way to set a Content-Security-Policy (CSP) header for LMS or CMS, but this is a powerful security measure that deployers can take. 2U is starting to experiment with this, and the CMS is a good place to start, since it is lower traffic.

Acceptance criteria:

• New Django settings to set a Content-Security-Policy header on CMS, or Content-Security-Policy-Report-Only, or both at the same time
• New Django setting to set a Reporting-Endpoints header on CMS to support CSP Level 3
• Ability to set these for the LMS as well at the same time, with different values
• Optionally: Ability to do a percentage rollout, maybe with Waffle

Presumably this would involve using a Django middleware. Possible ways to do this:

• CSP-specific settings and middleware in edx-platform (bad, because would have to reimplement in each IDA)
• Find a library that allows setting arbitrary headers
• Make a middleware in edx-django-utils or similar that allows setting CSP and related headers
• Find a CSP-specific library (e.g. https://github.com/mozilla/django-csp although that one doesn’t allow both CSP and CSP-RO at the same time)

Alternatively, give up and just do it at the CDN level, but this approach would not help the community as much.

Start by reviewing the Django settings and middleware approach described for edx-platform, then compare the proposed edx-django-utils and django-csp options. Done means CMS and LMS can independently configure CSP, CSP-Report-Only, and Reporting-Endpoints headers, with both policy modes supported together; percentage rollout is optional.