[Feature request]: Add a Content Security Policy

[emersion]

Create a Content Security Policy for NGE and embed it in a <meta> tag.

This would mitigate issues such as #702.

[aiAdrian]

The proposed change sounds reasonable. However, we need to ensure that the change does not affect the connection to the backend (Netzgrafik Editor) or cause any connection or communication issues. At the moment, I do not expect any risks here, but we should keep this in mind.

Afterwards, everything should be thoroughly tested against OSRD, as a JavaScript API is used there. This is where I see a potential risk of unintended side effects that could be triggered by the adjustment.

Nevertheless, I suggest proceeding with this change with high priority, as it increases overall software and system security.

We also need to consider the dependency that we must not interfere with the ongoing testing and bugfixing for version 2.10.x in the coming days. Therefore, we should evaluate whether it would be better to release this change with version 2.11 instead. However, I lack the experience to assess whether this could introduce potential risks for version 2.10, which is planned to go productive by mid‑February 2026.