refactor(ContentSecurityPolicy): replace plug

[thecristen]

Scope

Just another performance tweak.

Implementation

I realized that the |> ContentSecurityPolicy.Plug.AddSourceValue.call(runtime_directives) line isn't terribly performant, and does the exact same thing on every request. This PR avoids recomputing this result by doing the same work inside a function whose result will get saved in :persistent_term.

Note

🤖 I used AI only to crunch the before/after SVGs and generate the summary table/text!

Before & After

Before	After

Summary

Flamegraph comparison: DotcomWeb.Plugs.ContentSecurityPolicy.call/2

Metric	Before	After
Total time	2,468µs	300µs (~8.2x faster)
Dominant cost	AddSourceValue (88%, 2,175µs)	AddNonce (85%, 255µs)
Reduce nesting	13 nested levels (deepening stack)	1 flat pass
Enum.reject_list/2 calls	312	25
Enum.uniq_list/3 calls	197	25
Max stack depth	46 frames	35 frames

What changed: In the "before" trace, AddSourceValue's reduce over CSP directives nested each directive's work inside the previous one's frame, so uniq/reject scans re-ran at every level — roughly quadratic cost. In "after," that reduce runs as a single flat pass, cutting redundant list scans by ~8x and dropping total middleware time by ~88%.