feat: rework Content-security policy to be more readable

Author: Swiftb0y

netlify.toml

@@ -49,4 +49,33 @@
  for = "/news/*"
  [headers.values]
    # Additionally allow YouTube/Discourse frames and scripts and MathJax
-    Content-Security-Policy = "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'sha256-UPkidoMErzWw1gW/eY4LhAi9ZkPch3PP31d6KQoJ6Yc='  'sha256-G40wI6OaLZXCtrb02xUq1H1kEVWjstzoQ0FXKwsWxPw='	'sha256-1CldwzdEg2k1wTmf7s5RWVd7NMXI/7nxxjJM2C4DqII=' https://mixxx.discourse.group/javascripts/embed.js *.discourse-cdn.com; frame-src 'self' https://www.youtube-nocookie.com https://mixxx.discourse.group ; img-src 'self' https://i.ytimg.com https://raw.githubusercontent.com/mixxxdj/ ; connect-src 'self' https://mixxx.discourse.group https://*.discourse-cdn.com"
+   # Allow only same-origin by default
+   # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
+   Content-Security-Policy = '''
+     default-src 'self';
+     # Allow inline styles for MathJax, etc.
+     style-src 'self' 'unsafe-inline';
+     # Allow scripts from self, specific hashes (for MathJax), and Discourse embed
+     script-src
+       'self'
+       'sha256-UPkidoMErzWw1gW/eY4LhAi9ZkPch3PP31d6KQoJ6Yc=' # TODO
+       'sha256-G40wI6OaLZXCtrb02xUq1H1kEVWjstzoQ0FXKwsWxPw=' # TODO
+       'sha256-1CldwzdEg2k1wTmf7s5RWVd7NMXI/7nxxjJM2C4DqII=' # MathJax
+       https://mixxx.discourse.group/javascripts/embed.js
+       *.discourse-cdn.com;
+     # Allow frames from YouTube and Discourse
+     frame-src
+       'self'
+       https://www.youtube-nocookie.com
+       https://mixxx.discourse.group;
+     # Allow images from self, YouTube thumbnails, and Mixxx GitHub repo
+     img-src
+       'self'
+       https://i.ytimg.com
+       https://raw.githubusercontent.com/mixxxdj/;
+     # Allow connections to Discourse and its CDN, needed for Discourse embed
+     connect-src
+       'self'
+       https://mixxx.discourse.group
+       https://*.discourse-cdn.com
+   '''