DBC22-6457: Fix cross orgin resource policy

Author: wmuldergov

compose/frontend/default.conf

@@ -162,6 +162,7 @@ server {
         try_files $uri =404;
         expires    modified +1s;
         add_header Last-Modified "";
+        add_header Access-Control-Allow-Origin "*" always;
         include /etc/nginx/conf.d/security_headers.conf;
     }
 

compose/frontend/security_headers.conf

@@ -2,7 +2,7 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" alway
 add_header Permissions-Policy "geolocation=(self), fullscreen=*";
 add_header X-Content-Type-Options "nosniff";
 add_header X-Robots-Tag "noindex";
-add_header Cross-Origin-Opener-Policy "same-origin" always;
-add_header Cross-Origin-Resource-Policy "same-origin" always;
-add_header Cross-Origin-Embedder-Policy "credentialless" always;
+add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
+add_header Cross-Origin-Resource-Policy "cross-origin" always;
+add_header Referrer-Policy "no-referrer-when-downgrade";
 add_header Content-Security-Policy "default-src 'self' https://*.arcgis.com https://*.gov.bc.ca https://*.drivebc.ca https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ data: https://*.flickr.com https://*.staticflickr.com https://www.youtube.com https://*.ytimg.com; script-src 'self' https://*.gov.bc.ca https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://*.flickr.com https://*.staticflickr.com 'unsafe-inline'; style-src 'self' https://*.flickr.com https://*.staticflickr.com 'unsafe-inline'; frame-src https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://www.youtube.com https://www.youtube-nocookie.com; frame-ancestors 'self'; form-action 'self' https://*.drivebc.ca https://*.gov.bc.ca https://*.loginproxy.gov.bc.ca https://login.microsoftonline.com https://*.microsoftonline.com;";