Merge branch 'csp-header' into 'develop'

Add Content-Security-Policy header

See merge request pleroma/pleroma-fe!856

build/dev-server.js

@@ -24,6 +24,9 @@ var devMiddleware = require('webpack-dev-middleware')(compiler, {
   stats: {
     colors: true,
     chunks: false
+  },
+  headers: {
+    'content-security-policy': "base-uri 'self'; frame-ancestors 'none'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; manifest-src 'self'; script-src 'self' 'unsafe-eval';"
   }
 })