fix: csp report only to see which URLs will be blocked when using joule (#4417)

Author: chriskari

nginx/nginx.conf

@@ -38,7 +38,7 @@ http {
         root   /app/core-ui;
 
         add_header 'Cache-Control' 'public, max-age=300';
-        add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://kcp-dev-joule-vfglrzqg.eu12.sapdas.cloud.sap 'sha256-7fF0zlMDaJyxa8K3gkd0Gnt657Obx/gdAct0hR/pdds=' 'sha256-bjOtDHhqB+wVlyFDAxz9e0RvTn+EEec/Z4mpjUjNvAs=' blob:; frame-src 'self' https://kcp-dev-joule-vfglrzqg.eu12.sapdas.cloud.sap; style-src 'self' 'unsafe-inline'; connect-src 'self' * https://* wss://*; font-src 'self' data:; object-src 'none'; media-src 'self'; form-action 'self'; img-src * data:; worker-src 'self' blob: data:;";
+        add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' https://kcp-dev-joule-vfglrzqg.eu12.sapdas.cloud.sap 'sha256-7fF0zlMDaJyxa8K3gkd0Gnt657Obx/gdAct0hR/pdds=' 'sha256-bjOtDHhqB+wVlyFDAxz9e0RvTn+EEec/Z4mpjUjNvAs=' blob:; frame-src 'self' https://kcp-dev-joule-vfglrzqg.eu12.sapdas.cloud.sap; style-src 'self' 'unsafe-inline'; connect-src 'self' * https://* wss://*; font-src 'self' data:; object-src 'none'; media-src 'self'; form-action 'self'; img-src * data:; worker-src 'self' blob: data:;";
         add_header X-Frame-Options 'DENY';
         add_header X-Content-Type-Options 'nosniff';
         add_header Strict-Transport-Security 'max-age=31536000';