Conform with Isolated Web Apps HTTP CSP Header requirements

[gsiou]

Problem Statement

Isolated Web Apps (IWAs) provide an isolated, bundled, versioned, signed, and trusted application model built on top of the existing web platform.

The proposed solution specifies a rigorous Content Security Policy, to prevent attacks that would load malicious content from outside of its Web Bundle. This Content Security Policy would be beneficial to wwWallet not only to make it IWA eligible, but also enhance its current security.

The required CSP headers currently break existing features that:

• Use eval (e.g. Ajv library which is applied when validating json schemas)
• Load scripts without Trusted Type Policies (e.g the way VitePWA loads the service worker)

Until these are resolved, this feature cannot be implemented and will be considered blocked.
Related issues will be linked here to help tracking.