Proxy service crash loop on 8.1.0 upgrade: panic in loadCSPConfig, 'Cannot set options after data has been loaded

## Describe the bug
After upgrading from oCIS 8.0.5 to 8.1.0 (binary install, not Docker), the proxy service enters a permanent crash loop on startup. The panic occurs inside `loadCSPConfig`, regardless of whether `PROXY_CSP_CONFIG_FILE_LOCATION` is configured or not.

## Steps to reproduce
1. Run oCIS 8.0.5 (binary, systemd service, Ubuntu 24.04) in production with no `PROXY_CSP_CONFIG_FILE_LOCATION` configured
2. Stop the service, replace the binary with 8.1.0, start the service
3. Proxy service panics immediately in `loadCSPConfig`; the suture supervisor restarts it, it panics again, and this repeats indefinitely
4. As a test, created a minimal `csp.yaml` and set `PROXY_CSP_CONFIG_FILE_LOCATION` to point to it, then restarted — same crash, no change in behavior

## Expected behavior
Proxy service starts normally on 8.1.0, with or without a CSP config file present, the same as it did on 8.0.5.

## Actual behavior
Proxy service crash-loops indefinitely on startup with the following panic:

```console
panic: config: Cannot set options after data has been loaded, stacktrace: goroutine 10635 [running]:
github.com/thejerf/suture/v4.(*Supervisor).runService.func2.1()
github.com/thejerf/suture/v4@v4.0.6/supervisor.go:549 +0x7e
panic({0x5e83760?, 0x667f910?})
runtime/panic.go:783 +0x132
github.com/thejerf/suture/v4.(*Supervisor).runService.func2.2()
github.com/thejerf/suture/v4@v4.0.6/supervisor.go:566 +0xb1
panic({0x5e83760?, 0x667f910?})
runtime/panic.go:783 +0x132
github.com/gookit/config/v2.(*Config).WithOptions(0xc0038618c0?, {0xc00e469ea0?, 0x2c0?, 0xc00e469eb0?})
github.com/gookit/config/v2@v2.2.7/options.go:192 +0x8b
github.com/gookit/config/v2.WithOptions(...)
github.com/gookit/config/v2@v2.2.7/options.go:187
github.com/owncloud/ocis/v2/services/proxy/pkg/middleware.loadCSPConfig({0xc0038618c0, 0x2ae, 0x2c0})
github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/security.go:26 +0x46
github.com/owncloud/ocis/v2/services/proxy/pkg/middleware.LoadCSPConfig(0xc006d89640?)
github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/security.go:20 +0x5d
github.com/owncloud/ocis/v2/services/proxy/pkg/command.loadMiddlewares(...)
github.com/owncloud/ocis/v2/services/proxy/pkg/command/server.go:324 +0x10d2
github.com/owncloud/ocis/v2/services/proxy/pkg/command.Server.func2(...)
github.com/owncloud/ocis/v2/services/proxy/pkg/command/server.go:191 +0x1a11
github.com/owncloud/ocis/v2/ocis/pkg/runtime/service.NewService.func1(...)
github.com/owncloud/ocis/v2/ocis/pkg/runtime/service/service.go:131
github.com/owncloud/ocis/v2/ocis/pkg/runtime/service.NewService.func32(...)
github.com/owncloud/ocis/v2/ocis/pkg/runtime/service/service.go:297 +0xf5
github.com/owncloud/ocis/v2/ocis/pkg/runtime/service.NewService.NewService.func2.NewSutureServiceBuilder.func76.1(...)
github.com/owncloud/ocis/v2/ocis/pkg/runtime/service/sutureservice.go:20 +0x25
github.com/owncloud/ocis/v2/ocis/pkg/runtime/service.SutureService.Serve(...)
github.com/owncloud/ocis/v2/ocis/pkg/runtime/service/sutureservice.go:28 +0x26
github.com/thejerf/suture/v4.(*Supervisor).runService.func2()
github.com/thejerf/suture/v4@v4.0.6/supervisor.go:570 +0xd8
created by github.com/thejerf/suture/v4.(*Supervisor).runService in goroutine 82
github.com/thejerf/suture/v4@v4.0.6/supervisor.go:544 +0x18b
```

## Setup
Single-node binary install (not Docker), Ubuntu 24.04, oCIS started as a systemd service (`ocis server`). No CSP configuration was previously in use on 8.0.5.

```console
OCIS_INSECURE=false
PROXY_ENABLE_BASIC_AUTH=false
PROXY_CSP_CONFIG_FILE_LOCATION=/etc/ocis/csp.yaml
```

Note: the crash occurs identically with `PROXY_CSP_CONFIG_FILE_LOCATION` unset, and with it set to a minimal valid file (`directives: {default-src: ["'self'"]}`). Included above since it was set at the time of the last reproduction.

## Additional context
- Previously running 8.0.5 (compiled June 19, 2026) stably for several weeks with no proxy issues
- Upgrade performed as a binary swap per the official upgrade docs, which state no manual migration steps are required for 8.0.x releases
- Reverted to the 8.0.5 binary as a workaround; service runs normally on that version
- This also blocked testing of the `ocis postprocessing resume --restart` fix shipped in 8.1.0, which was the original reason for attempting this upgrade

Start in services/proxy/pkg/middleware/security.go at loadCSPConfig and LoadCSPConfig, then trace their caller in services/proxy/pkg/command/server.go. Reproduce the 8.1.0 startup with CSP unset and with the minimal configuration described in the issue. Done means the proxy starts without the config panic in both cases and the relevant tests pass.

Written by the indexing model from the issue text.